VYPR
← All advisories
High severityNVD Advisory· Published Oct 4, 2019· Updated Aug 5, 2024

CVE-2019-16865

CVE-2019-16865

Description

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 6.2.0 can cause excessive memory allocation or extremely long processing times when reading specially crafted invalid image files, leading to denial of service.

Vulnerability

Overview

CVE-2019-16865 is a denial of service vulnerability in the Pillow Python imaging library, affecting versions prior to 6.2.0. The issue occurs when the library processes specially crafted invalid image files, causing either the allocation of very large amounts of memory or an extremely lengthy processing time [1][2][3][4]. This behavior stems from improper validation of image data, which can trigger resources exhaustion without requiring authentication or user interaction beyond opening the malicious file.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted image file to a victim. No special privileges are needed; the victim merely needs to open or process the file with Pillow. The attack surface includes any application that uses Pillow to handle user-supplied images, such as web services, image uploaders, or processing pipelines [2][4]. The crafted file can be delivered via email, web upload, or any other means of file sharing.

Impact

Successful exploitation leads to a denial of service condition. The excessive memory consumption or prolonged processing can exhaust system resources, causing the application to slow down, freeze, or crash entirely [2][3][4]. This can disrupt services relying on Pillow, potentially affecting availability for legitimate users.

Mitigation

The vulnerability is fixed in Pillow version 6.2.0 and later. Red Hat, Ubuntu, and other distributors have released patches for their respective platforms [1][2][4]. Users are strongly advised to update to the latest version of Pillow. No workarounds are known; updating is the recommended mitigation.

References
  1. https://access.redhat.com/errata/RHSA-2020:0580
  2. https://access.redhat.com/errata/RHSA-2020:0578
  3. NVD - CVE-2019-16865
  4. USN-4272-1: Pillow vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 6.2.06.2.0

Affected products

299

Patches

1
8a30d135378d

Updated CHANGES.rst [ci skip]

https://github.com/python-pillow/pillowAndrew MurrayOct 1, 2019via osv
commit
1 file changed · +1 −1
  • CHANGES.rst+1 −1 modified
    @@ -2,7 +2,7 @@
 Changelog (Pillow)
 ==================
 
-6.2.0 (unreleased)
+6.2.0 (2019-10-01)
 ------------------
 
 - This is the last Pillow release to support Python 2.7 #3642

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

20

News mentions

0

No linked articles in our index yet.