Search: 13.3-13

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested PDF to an application that saves an image with PDF append enabled. This can raise an uncaught RecursionError or terminate the worker, causing denial of service. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.

Since September 15, 2026, the Gheist campaign has been abusing stolen GitHub tokens to commit a malicious workflow named sync-check to accessible repositories. This workflow attempts to print repository secrets into logs, which are then exfiltrated via GitHub's API before the logs are deleted. The campaign has affected over 850 compromised accounts and more than 13,500 planted branches, impacting both personal and enterprise private repositories. GitHub's approval controls have prevented exploitation in public repositories, but private and enterprise repositories remain vulnerable. The campaign operates without a command-and-control server, uses the user agent 'gheist', and has multiple evolving variants. Approximately two-thirds of affected accounts have been removed by GitHub, likely as a response measure.

CVE-2026-107090 is a vulnerability in Maltego Technologies GmbH Maltego Windows Installer version 4.13.0 that allows a local attacker to execute arbitrary code via the installer executable-resolution logic.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a heap-based buffer overflow vulnerability in the X11 animate operation. This flaw allows an attacker to supply a crafted image that, when processed with the X11 animate operation, can overwrite heap memory and crash the application. The vulnerability has a low severity score and does not impact confidentiality or integrity but can cause denial of service through application crashes.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in the handling of the -cdl (color decision list) option. This flaw causes allocated memory not to be freed after use, potentially leading to resource exhaustion if exploited repeatedly. The vulnerability has a low severity rating and a CVSS score of 3.3. No known exploits are reported in the wild.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability triggered by the use of the -set profile option. This flaw can cause memory exhaustion and potentially lead to denial of service if an attacker convinces a user to process crafted images using this option. The vulnerability has a low severity rating with a CVSS score of 3.3.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the handling of XMP profiles by various decoders. An attacker can supply images with crafted XMP profiles that cause memory to leak each time they are processed, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.3.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a memory leak vulnerability in their XML parsing code. The leak occurs when parsing reaches the nesting depth limit, causing allocated memory not to be released. An attacker can exploit this by supplying crafted deeply nested XML data to trigger memory exhaustion, resulting in a denial of service condition.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the JNG encoder. This flaw causes allocated memory to not be released when processing crafted JNG images, potentially leading to resource exhaustion and a limited denial of service.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a stack-based buffer overflow vulnerability in the handling of bzip2 compressed images. This flaw allows attackers to supply crafted bzip2 compressed images that can overwrite stack memory during decoding, potentially causing crashes or memory corruption. The vulnerability has a high severity rating with a CVSS score of 8.1.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a null pointer dereference vulnerability in the DJVU image decoder. This occurs because the software does not check the result of a memory allocation before use. An attacker can supply a specially crafted DJVU image that triggers a process crash under memory allocation failure conditions, resulting in denial of service.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the MSL decoder. This flaw causes allocated memory to not be released when processing crafted MSL images, potentially leading to resource exhaustion and denial of service.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 contain a security policy bypass vulnerability due to an incomplete fix of a previous bypass issue. This flaw allows an attacker who can supply input to ImageMagick to circumvent configured security policy restrictions, enabling operations that should have been blocked by the policy. The vulnerability has a low severity rating with a CVSS score of 3.9.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process. The vulnerability has a low severity rating and does not impact confidentiality or integrity.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a policy bypass vulnerability in the PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's list length limit on scene selection by supplying a specific argument, causing ImageMagick to process more scenes than permitted. The vulnerability can potentially lead to resource exhaustion. The CVSS score is 3.3, indicating a low severity impact primarily affecting availability.

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a vulnerability in delegate invocation parsing that allows execution of programs blocked by policy.xml. An attacker can exploit this by crafting input that triggers a delegate invocation, bypassing administrator-defined execution restrictions.