VYPR
← All advisories
High severityNVD Advisory· Published Jan 5, 2020· Updated Aug 5, 2024

CVE-2019-19911

CVE-2019-19911

Description

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 6.2.2 has a DoS via FpxImagePlugin.py using an unvalidated 32-bit integer for range() on large bands, causing OOM on 64-bit Linux or MemoryError on 32-bit Windows.

Description

The vulnerability is a denial-of-service (DoS) flaw in the Pillow Python imaging library, present in versions before 6.2.2. The issue originates in FpxImagePlugin.py, where the range() function is called with an unvalidated 32-bit integer derived from the number of image bands. When a specially crafted FPX image specifies a very large number of bands, this integer can be extremely large, leading to resource exhaustion [1][2].

Exploitation

An attacker can trigger the vulnerability by providing a malicious FPX image file to an application using Pillow. The attack requires no authentication and can be delivered remotely, for example through a web service that accepts image uploads. The core problem lies in the lack of input validation on the band count before it is used to allocate memory via range() [2][3].

Impact

The impact depends on the platform. On 32-bit Windows systems with Python, the large allocation attempt triggers an OverflowError or MemoryError due to the 2 GB process memory limit, causing the application to crash. On 64-bit Linux systems, the process may be terminated by the out-of-memory (OOM) killer, also resulting in a denial of service. No code execution or data exfiltration is possible [2][4].

Mitigation

The vulnerability is fixed in Pillow version 6.2.2, released on 2020-01-02. Users should upgrade to this version or later. The Ubuntu security notice USN-4272-1 also addresses this CVE, along with several others [1][3]. No workarounds beyond upgrading are documented.

References
  1. Pillow/CHANGES.rst at main · python-pillow/Pillow
  2. NVD - CVE-2019-19911
  3. USN-4272-1: Pillow vulnerabilities | Ubuntu security notices | Ubuntu
  4. CVE-2019-19911 - GitHub Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 6.2.26.2.2

Affected products

299

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.