Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Pillow library can let attackers run code

CVE-2021-34552 · published today
Summary

The Python Pillow image library used in many Linux distributions and Python projects can be tricked into executing malicious code when it processes specially crafted image files. This risk is fixed in newer releases of Pillow. Install the latest Pillow version from your package manager or PyPI to stay safe.

What to do
  • Update jeffrey 'alex' clark pillow to version 8.3.0.
  • Update pillow to version 8.0.1+aikido.1.
  • Update pillow to version 8.1.2+aikido.1.
  • Update pillow to version 8.0.1+aikido.2.
Affected software
Ecosystem VendorProductAffected versions
pip jeffrey 'alex' clark pillow < 8.3.0
Fix: upgrade to 8.3.0
– python pillow >= 1.0, <= 1.1.7
>= 1.2, <= 8.2.0
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– fedoraproject fedora 33
34
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Root:PyPI – pillow < 8.0.1+aikido.1
< 8.1.2+aikido.1
< 8.0.1+aikido.2
Fix: upgrade to 8.0.1+aikido.1
Original advisory text
CVE-2021-34552 in pillow - Patched by Root
Root has patched CVE-2021-34552 in the pillow package for Root:PyPI. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-120Classic Buffer Overflow
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen6 Mar 2026
Sources
GHSA-7534-mm45-c74v · GHSA
CVE-2021-34552 · NVD
ROOT-APP-PYPI-CVE-2021-34552 · OSV
Track software like this
Free during beta