pillow

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow has a heap buffer overflow with nested list coordinates

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Pillow affected by out-of-bounds write when loading PSD images

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

FITS GZIP decompression bomb in Pillow

Pillow has an integer overflow when processing fonts

Pillow vulnerability can cause write buffer overflow on BCn encoding

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`