Pillow buffer overflow vulnerability

MEDIUM 5.9CVE-2024-28219 · BIT-pillow-2024-28219 · GHSA-44wm-f244-xhp3 · Published 03/04/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 10.3.0`	`10.3.0`
pillow python	`< 10.3.0`	`10.3.0`

Description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

NVD description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.