VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 7, 2022· Updated Aug 3, 2024

CVE-2022-22816

CVE-2022-22816

Description

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2022-22816 is a buffer over-read in Pillow's ImagePath.Path initialization affecting versions before 9.0.0, enabling information disclosure.

Vulnerability

In Pillow (Pillow) before 9.0.0, the function path_getbbox in src/path.c suffers from a buffer over-read (CWE-665) during initialization of ImagePath.Path. The issue is fixed in version 9.0.0 (released 2022-01-02) [1][4]. The vulnerable code path is triggered when creating an ImagePath.Path object with certain array inputs, leading to out-of-bounds memory access.

Exploitation

An attacker can trigger the vulnerability by crafting a malformed array and passing it to ImagePath.Path initializer. No authentication or special privileges are required; the attack vector is network-based with low attack complexity [2]. The attacker must only supply a specially crafted input that causes the internal path initialization logic to read beyond the allocated buffer.

Impact

Successful exploitation allows an attacker to read adjacent memory, potentially leaking sensitive information from the process's address space. This information disclosure could expose secrets such as cryptographic keys, credentials, or other confidential data handled by the same Python process [1][2][3].

Mitigation

Users should upgrade to Pillow 9.0.0 or later, which contains the fix [1][4]. The fix is included in the official release and backported to security-supported branches. No workaround is available for unpatched versions; upgrading immediately is recommended.

References
  1. CVE-2022-22815, CVE-2022-22816: Fixed ImagePath.Path array handling by radarhere · Pull Request #5920 · python-pillow/Pillow
  2. CVE-2022-22816 - GitHub Advisory Database
  3. NVD - CVE-2022-22816
  4. 9.0.0 (2022-01-02)

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 9.0.09.0.0

Affected products

54

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.