Is pillow healthy, maintained, and safe?
No. pillow carries 15 unpatched critical advisories and should not be adopted without a remediation plan.
The verdict
OSPulse scores pillow at 55/100 (medium risk), computed deterministically from live PyPI release history, and the OSV vulnerability database. No. pillow carries 15 unpatched critical advisories and should not be adopted without a remediation plan.
Its most recent release shipped on 16 October 2026, 9 days ago, so development is clearly active. Across 108 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. PyPI doesn't expose a reliable maintainer count, so bus-factor isn't scored here. Treat maintenance depth as unknown rather than assumed.
OSV lists 194 known advisories for pillow, including 15 critical and 73 high. Open critical advisories are the strongest possible signal to pin to a patched version, replace, or fork before shipping. Each advisory is listed with its OSV/GHSA identifier below.
pillow is usable but carries real signals, so pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package. Real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own requirements.txt through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail: deterministic, auditable
Known vulnerabilities (194)
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow buffer overflow in ImagingPcdDecode
Arbitrary Code Execution in Pillow
Pillow: TarIO negative size field causes infinite CPU-spin loop
Pillow Uncontrolled Resource Consumption
Out-of-bounds read in Pillow
Out-of-bounds read in Pillow
Pillow buffer overflow vulnerability
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Infinite loop in Pillow
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
Out of bounds write in Pillow
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Uncontrolled Resource Consumption in Pillow
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow has a heap buffer overflow with nested list coordinates
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
Buffer Overflow in Pillow
Out-of-bounds Read in Pillow
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Potential infinite loop in Pillow
Buffer overflow in Pillow
Pillow: Heap buffer overflow in ImagingJpegDecode
Pillow Denial of Service vulnerability
Pillow command injection
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Arbitrary expression injection in Pillow
Out-of-bounds Write in Pillow
Pillow Buffer overflow in ImagingFliDecode
Pillow Denial of Service by Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in pillow
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Regular Expression Denial of Service (ReDoS) in Pillow
Path traversal in Pillow
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow affected by out-of-bounds write when loading PSD images
Pillow denial of service via Crafted Block Size
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Out-of-bounds reads in Pillow
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow Denial of Service by Uncontrolled Resource Consumption
Pillow Out-of-bounds Read
Pillow: Quadratic GIF comment copying during save
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow denial of service
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Pillow denial of service via PNG bomb
Pillow Out-of-bounds Read
Pillow Buffer overflow in ImagingLibTiffDecode
Out-of-bounds Read in Pillow
Insufficient Verification of Data Authenticity in Pillow
Buffer over-flow in Pillow
Pillow Integer overflow in ImagingResampleHorizontal
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is vulnerable to Denial of Service (DOS) in the Jpeg2KImagePlugin
libwebp: OOB write in BuildHuffmanTable
DOS attack in Pillow when processing specially crafted image files
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
- GHSA-jgpv-4h4c-xhw3 ↗MODERATE
Uncontrolled Resource Consumption in pillow
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Pillow vulnerable to Data Amplification attack.
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Out of bounds read in Pillow
Out of bounds read in Pillow
PCX P mode buffer overflow in Pillow
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
Improper Initialization in Pillow
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow subject to DoS via SAMPLESPERPIXEL tag
Uncontrolled Resource Consumption in Pillow
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
Buffer Copy without Checking Size of Input in Pillow
Pillow Temporary file name leakage
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow Integer overflow in Map.c
Pillow Out-of-bounds Read vulnerability
Pillow Buffer overflow in Jpeg2KEncode.c
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Integer overflow in Pillow
Out-of-bounds reads in Pillow
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Pillow Out-of-bounds Write
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
Arbitrary code using "crafted image file" approach affecting Pillow
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
FITS GZIP decompression bomb in Pillow
Pillow has an integer overflow when processing fonts
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
Pillow vulnerability can cause write buffer overflow on BCn encoding
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Out-of-bounds Read in Pillow
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
- OSV-2022-1074 ↗UNKNOWN
Invalid-free in _dealloc
- OSV-2022-715 ↗UNKNOWN
Segv on unknown address in jpeg_read_scanlines
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (P
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibl
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) v
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_b
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in S
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of tim
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit P
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Imag
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempt
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempte
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally qu
An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
- PYSEC-2023-175 ↗UNKNOWN
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer
Pillow buffer overflow vulnerability
libwebp: OOB write in BuildHuffmanTable
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attack
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygo
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code ex
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._dec
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() wit
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompress
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in I
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file t
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image who
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilte
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Arbitrary Code Execution in Pillow
Key facts
- Latest version
- v13.0.0
- Last release
- 16 October 2026 (9 days ago)
- Total releases
- 108
- First release
- 31 July 2010
- Package age
- 16.2 years
- Maintainers
- not exposed by PyPI
- Known advisories
- 194
- Confidence
- High
Frequently asked
Is pillow still maintained?
Yes. pillow released as recently as 16 October 2026 (9 days ago), so it is actively maintained.
Does pillow have known security vulnerabilities?
Yes. OSV lists 194 advisories for pillow, including 15 rated critical. See the advisory list on this page for the OSV/GHSA identifiers.
Is pillow safe to use?
No. pillow carries 15 unpatched critical advisories and should not be adopted without a remediation plan. OSPulse rates it 55/100 (medium risk) based on release recency, cadence and known vulnerabilities.
Other PyPI packages we've checked
pillow is one package. What about the other hundreds in your tree?
Paste your own requirements.txt into the free health check for an instant snapshot, or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the PyPI registry & OSV.dev · snapshot generated 2026-10-26 · scores are deterministic and recomputed on each refresh.