OSV-2022-1074

Invalid-free in _dealloc

Not rated yet PyPI

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: None yet; No fixed version published

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52587

Crash type: Invalid-free
Crash state:
_dealloc
_Py_DECREF
frame_dealloc

Affected versions

PyPI

Package	Vulnerable	Fixed in
pillow	3 listed versions	No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

References

Issue reports

bugs.chromium.org/p/oss-fuzz/issues/detail

Timeline

Oct 22, 2022 Published
Nov 9, 2022 Last updated by the source

Advisory	Severity	Why it's related
PYSEC-2023-175 Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863).	High Known exploited	Also affects pillow
GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable	High Known exploited	Also affects pillow
GHSA-78g4-xqwv-q3g8 Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()	High	Also affects pillow
GHSA-654x-cwwv-5j9c Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1	Medium	Also affects pillow
GHSA-xvh5-g6gv-559v Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags	High	Also affects pillow
GHSA-g7cr-3p24-7wf7 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer	High	Also affects pillow
GHSA-9v9v-9qvf-h2hj Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)	High	Also affects pillow
GHSA-g4qv-2jxx-769h Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time	Medium	Also affects pillow

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor