python-pillow

A new vulnerability, EUVD-2026-107575, has been catalogued for Pillow, the widely used Python imaging library maintained by python-pillow. Rated 6.3 out of 10 under CVSS v3.1, the flaw affects versions from 11.2.1 up to 13.0.0, where Arrow export incorrectly assumes image rows are tightly contiguous and reads from an incorrect memory pointer. Security teams are urged to check whether their dependencies are exposed.

A new vulnerability, EUVD-2026-104635, has been catalogued in Pillow, the widely used Python image processing library, with a CVSS v3.1 score of 8.7. The flaw lies in APNG background disposal, which allocates the full canvas before the decompression bomb check runs, potentially enabling denial-of-service via memory exhaustion. Security teams are being urged to review affected versions.

A new vulnerability, EUVD-2026-104632, has been published affecting Pillow, the widely used Python imaging library. Versions 11.3.0 through 13.0.0 contain a heap use-after-free bug that triggers when libtiff rejects a tag during TIFF encoding. The flaw carries a CVSS v3.1 score of 5.9 out of 10, marking it as medium severity. It was published on 20 October 2026, and security teams running affected versions are being urged to review and patch.

A high-severity vulnerability, EUVD-2026-104603, has been catalogued in Pillow, the widely used Python image library. The flaw, scored 9.2 out of 10 under CVSS v3.1, is a heap buffer overflow in the _tiffWriteProc function, triggered when saving TIFF images to a BytesIO stream. Security teams are being urged to review the advisory and check whether their applications use the affected code path.

A new vulnerability, EUVD-2026-104638, has been published affecting Pillow, the widely used Python imaging library maintained by the python-pillow project. Versions from 5.4.0 to 13.0.0 carry a flaw in GIF comment parsing, where quadratic copying can cause excessive processing. The issue is rated 6.9 out of 10 on the CVSS v3.1 scale and was published on 19 October 2026 with an update the following day. Developers running affected versions are being urged to check and upgrade.