Out-of-bounds Read in Pillow

MEDIUM 6.5CVE-2022-22816 · BIT-pillow-2022-22816 · GHSA-xrcv-f9gm-v42c · Published 10/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 9.0.0`	`9.0.0`
pillow python	`< 9.0.0`	`9.0.0`

Description

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

NVD description

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.