VYPR
← All advisories
High severityNVD Advisory· Published Jun 25, 2020· Updated Aug 4, 2024

CVE-2020-10177

CVE-2020-10177

Description

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 7.1.0 contains multiple out-of-bounds reads in the FLI decoder, which can be triggered by a crafted FLI file.

Root

Cause

The vulnerability lies in libImaging/FliDecode.c within Pillow, a popular Python imaging library. The code performs multiple out-of-bounds reads when decoding FLI (Autodesk Animator) files. These reads occur because insufficient bounds checking is applied to the input data, allowing an attacker to craft a malicious FLI file that causes the decoder to read beyond the allocated buffer. [1]

Exploitation

To exploit CVE-2020-10177, an attacker must supply a specially crafted FLI file to an application that uses Pillow's image processing capabilities. No authentication or special network position is required beyond the ability to deliver the file to the victim (e.g., via email, web upload, or direct file access). The vulnerability is triggered during parsing of the FLI container, specifically in the frame decoding routines. The attack complexity is high, as it requires precise crafting of the file to cause the out-of-bounds read without causing a crash that halts processing. [2] [4]

Impact

Successful exploitation could lead to information disclosure via the out-of-bounds read, as the decoder may leak sensitive memory contents. Although this is not a remote code execution vulnerability, it can expose data that may aid in further attacks. The CVSS v3.1 base score is 5.5 (Medium), reflecting the potential for confidentiality impact. [2]

Mitigation

The fix was merged in Pull Request #4503 and released in Pillow version 7.1.0. Users are strongly advised to upgrade to Pillow 7.1.0 or later. No workarounds are available for older versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been disclosed as of the publication date. [1] [3]

References
  1. Fix multiple OOB reads in FLI decoding by hugovk · Pull Request #4503 · python-pillow/Pillow
  2. NVD - CVE-2020-10177
  3. Update 7.1.0 release notes with CVEs by hugovk · Pull Request #4538 · python-pillow/Pillow
  4. CVE-2020-10177 - GitHub Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 7.1.07.1.0

Affected products

270

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

30

News mentions

0

No linked articles in our index yet.