Out of bounds read in Pillow

ALTO 7.5CVE-2021-25291 · BIT-pillow-2021-25291 · GHSA-mvg9-xffr-p774 · Published 19/03/2021 · updated 17/06/2026

In breve

CVE-2021-25291 è una vulnerabilità ALTO (CVSS 7.5) che riguarda pillow, pillow (python).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 72.5% delle vulnerabilità.
Correzione: aggiornare a 8.1.1, 8.2.0 o successiva.

Package	Affected versions	Patched versions
pillow PyPI	`< 8.1.1< 8.2.0`	`8.1.18.2.0`
pillow python	`< 8.1.1`	`8.1.1`

An issue was discovered in Pillow before 8.2.0. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

NVD description

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 8.1.1< 8.2.0

8.1.18.2.0

< 8.1.1

8.1.1

Description

An issue was discovered in Pillow before 8.2.0. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

NVD description

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

Altre vulnerabilità di pillow

Vedi tutto →