Pillow vulnerable to Data Amplification attack.

published 2022-11-14 3 y ago modified 2026-09-08 2 mo ago also BIT-pillow-2022-45198 , EUVD-2022-0197 , GHSA-m2vv-5vj5-2hm7 , PYSEC-2022-42979

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Patch / fix

fixed in 3 distros 4 links 5

pypi pillow 9.2.0
bitnami pillow 9.2.0
python pillow 9.2.0

debian ubuntu suse opensuse

pillow Debian 14, Debian 13, Debian 12 9.2.0-1

debian advisories DEBIAN-CVE-2022-45198

pillow Ubuntu 20.04 LTS 7.0.0-4ubuntu0.7
pillow Ubuntu 22.04 LTS 9.0.1-1ubuntu0.1
pillow-python2 Ubuntu Pro 20.04 LTS 6.2.1-3ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-45198

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-Pillow SLE Module for Package Hub 15 SP6, openSUSE Leap 15.5 7.2.0-150300.3.18.1

suse advisories SUSE-SU-2024:2908-1

python-Pillow Package Hub 15 SP5, openSUSE Leap 15.5 8.4.0-bp155.3.9.1

opensuse advisories openSUSE-SU-2024:0253-1

github.com/python-pillow/Pillow@11918ea commit
github.com/python-pillow/Pillow#6402 commit
github.com/python-pillow/Pillow#6402 pull request
github.com/python-pillow/Pillow/releases/tag/9.2.0 release
bugs.gentoo.org/855683 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-203-04 updated 2026-02-25 cvss 7.5

Schneider Electric EcoStruxure Power Operation (Update A)

Schneider Electric EcoStruxure Power Operation (EPO) 2022 <=CU6 Schneider Electric EcoStruxure Power Operation (EPO) 2024 <=CU1
affected: mitigation “If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:” community.se.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	pillow	<9.2.0	9.2.0
bitnami	pillow	<9.2.0	9.2.0

Classification

Weakness

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

References

github.com /python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
web, patch, third-party-advisory, advisory
github.com /python-pillow/Pillow/pull/6402
web, patch, third-party-advisory, advisory
bugs.gentoo.org /855683
web, issue-tracking, patch, third-party-advisory, advisory
github.com /python-pillow/Pillow/pull/6402/commits/c9f1b35e981075110a23487a8d4a6cbb59a588ea
web
security.gentoo.org /glsa/202211-10
vendor-advisory, web, third-party-advisory, advisory
github.com /python-pillow/Pillow/releases/tag/9.2.0
web, release-notes, third-party-advisory, advisory
cwe.mitre.org /data/definitions/409.html
web, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2022-45198
advisory, web
github.com /pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-42979.yaml
web
github.com /python-pillow/Pillow
web
github.com /advisories/GHSA-m2vv-5vj5-2hm7
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary