VYPR
← All advisories
High severityNVD Advisory· Published Jun 25, 2020· Updated Aug 4, 2024

CVE-2020-10378

CVE-2020-10378

Description

In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 7.1.0 has an out-of-bounds read in PCX decoding that can be triggered by a crafted file, leading to a denial of service.

Vulnerability

In libImaging/PcxDecode.c in Pillow before version 7.1.0, an out-of-bounds read vulnerability exists when processing specially crafted PCX image files. The root cause is that the state->shuffle function is instructed to read beyond the allocated state->buffer, which can lead to reading memory outside the intended bounds [1][2]. This issue is classified as CWE-125 (Out-of-bounds Read).

Exploitation

To exploit this vulnerability, an attacker must trick a user or automated system into opening a maliciously crafted PCX image file using an affected version of Pillow. No authentication or special network position is required; the attack vector is local in the sense that the file must be processed, but it can be delivered remotely (e.g., via a website or email attachment). The flaw does not require any privileges beyond the ability to induce the target application to decode the image [3][4].

Impact

Successful exploitation results in an out-of-bounds read, which can cause the application to crash, leading to a denial of service (DoS). There is no evidence from the available sources that this vulnerability allows arbitrary code execution or data exfiltration; the primary impact is instability of the software [3][4]. The CVSS v3.1 base score is 7.5 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [2].

Mitigation

The vulnerability is fixed in Pillow version 7.1.0 and later. Users should upgrade to the latest version of Pillow. Ubuntu and other distributions have released security updates addressing this issue [4]. No workarounds are documented; updating the library is the recommended action.

References
  1. Update 7.1.0 release notes with CVEs by hugovk · Pull Request #4538 · python-pillow/Pillow
  2. NVD - CVE-2020-10378
  3. CVE-2020-10378 - GitHub Advisory Database
  4. USN-4430-1: Pillow vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 7.1.07.1.0

Affected products

270

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

19

News mentions

0

No linked articles in our index yet.