VYPR
← All advisories
High severityNVD Advisory· Published Jun 25, 2020· Updated Aug 4, 2024

CVE-2020-10994

CVE-2020-10994

Description

In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 7.1.0 contains multiple out-of-bounds reads in its JP2 decoder, exploitable via a crafted JP2 file.

Vulnerability

Overview

CVE-2020-10994 is a set of out-of-bounds read vulnerabilities in the JPEG 2000 decoder (Jpeg2KDecode.c) of the Pillow Python imaging library, affecting versions prior to 7.1.0. The root cause lies in insufficient bounds checking when processing crafted JP2 files, allowing an attacker to trigger out-of-bounds memory reads [1][3].

Exploitation

The vulnerability is exploitable by convincing a user or automated system to open a specially crafted JP2 image file. No authentication is required, and the attack can be delivered remotely (e.g., via email, web download, or file upload). No special privileges are needed, as the decoder processes user-supplied images in many common workflows [1][3][4].

Impact

Successful exploitation could cause Pillow to crash, resulting in a denial of service. Under certain conditions, the out-of-bounds reads could potentially expose sensitive memory contents, though the primary documented impact is application termination [1][4].

Mitigation

The fix was released in Pillow version 7.1.0 [2][3]. Users should upgrade immediately. Distributions such as Ubuntu have provided updated packages (USN-4430-2) for their supported releases [4].

References
  1. NVD - CVE-2020-10994
  2. Update 7.1.0 release notes with CVEs by hugovk · Pull Request #4538 · python-pillow/Pillow
  3. CVE-2020-10994 - GitHub Advisory Database
  4. USN-4430-2: Pillow vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 7.1.07.1.0

Affected products

270

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

21

News mentions

0

No linked articles in our index yet.