Arbitrary code using "crafted image file" approach affecting Pillow

HOCH 7.8CVE-2016-9190 · GHSA-w4vg-rf63-f3j3 · PYSEC-2016-9 · Published 04/11/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 3.3.2`	`3.3.2`
pillow python	`≤ 3.3.1`	No fix yet

Description

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-9190 · ADVISORY
python-pillow/Pillow · WEB
python-pillow/Pillow#2146 · WEB
GitHub Advisory GHSA-w4vg-rf63-f3j3 · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
security.gentoo.org/glsa/201612-52 · WEB
pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html · WEB
debian.org/security/2016/dsa-3710 · WEB
securityfocus.com/bid/94234 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free