CVE-2024-28219Medium· 6.7▾ SunlitPillow buffer overflow vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.0%
Last analysed / modified upstream
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
pillow < 10.3.0Upgrade to a patched release:
pillow 10.3.0Connected by shared product, vendor, weakness, or advisory.
GHSA-78g4-xqwv-q3g8High· 8.1Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().l…
CVE-2026-96637High· 6.5Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96640High· 8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96636Medium· 6.5Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CVE-2026-114501Medium· 5.3Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1