VYPR
← All advisories
High severityNVD Advisory· Published Jan 3, 2020· Updated Aug 4, 2024

CVE-2020-5313

CVE-2020-5313

Description

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer overflow in Pillow's FLI decoder (FliDecode.c) before 6.2.2 could allow arbitrary code execution via crafted FLI image.

CVE-2020-5313 is a heap buffer overflow vulnerability in the FLI decoder (libImaging/FliDecode.c) of Pillow, an open-source Python imaging library. The flaw arises from insufficient validation of FLI image data, allowing an attacker to write beyond allocated memory boundaries [1][2].

To exploit the vulnerability, an attacker must convince a target to process a specially crafted FLI image file using an affected version of Pillow. No authentication is required; the attack vector is remote via file upload or similar means [2][4].

Successful exploitation could lead to arbitrary code execution or cause a denial of service due to memory corruption. The precise impact depends on the platform and exploitation details [2][3].

The issue was patched in Pillow version 6.2.2, released on 2020-01-02 [1]. Users are advised to update to this version or later. Ubuntu users can apply security updates as per USN-4272-1 [3].

References
  1. Pillow/CHANGES.rst at main · python-pillow/Pillow
  2. NVD - CVE-2020-5313
  3. USN-4272-1: Pillow vulnerabilities | Ubuntu security notices | Ubuntu
  4. CVE-2020-5313 - GitHub Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
PillowPyPI
< 6.2.26.2.2

Affected products

300

Patches

2
a45c8583ff90

Release notes for 6.2.2

https://github.com/python-pillow/pillowAndrew MurrayJan 2, 2020via osv
commit
1 file changed · +1 −0
  • docs/releasenotes/index.rst+1 −0 modified
    @@ -6,6 +6,7 @@ Release Notes
 .. toctree::
   :maxdepth: 2
 
+  6.2.2
   6.2.1
   6.2.0
   6.1.0
a09acd0decd8

Catch FLI buffer overrun

https://github.com/python-pillow/pillowAndrew MurrayJan 1, 2020via osv
commit
3 files changed · +12 −2
  • src/libImaging/FliDecode.c+5 −2 modified
    @@ -40,8 +40,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt
 	return 0;
 
     /* We don't decode anything unless we have a full chunk in the
-       input buffer (on the other hand, the Python part of the driver
-       makes sure this is always the case) */
+       input buffer */
 
     ptr = buf;
 
@@ -52,6 +51,10 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt
     /* Make sure this is a frame chunk.  The Python driver takes
        case of other chunk types. */
 
+    if (bytes < 8) {
+        state->errcode = IMAGING_CODEC_OVERRUN;
+        return -1;
+    }
     if (I16(ptr+4) != 0xF1FA) {
 	state->errcode = IMAGING_CODEC_UNKNOWN;
 	return -1;
  • Tests/images/fli_overrun2.bin+0 −0 added
  • Tests/test_image.py+7 −0 modified
    @@ -598,6 +598,13 @@ def test_overrun(self):
             except IOError as e:
                 self.assertEqual(str(e), "buffer overrun when reading image file")
 
+        with Image.open("Tests/images/fli_overrun2.bin") as im:
+            try:
+                im.seek(1)
+                self.assertFail()
+            except IOError as e:
+                self.assertEqual(str(e), "buffer overrun when reading image file")
+
 
 class MockEncoder(object):
     pass

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.