CVE-2020-35654: Pillow Out-of-bounds Write
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.44239%
CWE
Published
3/18/2021
Updated
10/11/2024
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
Pillow | pip | < 8.1.0 | 8.1.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from the original ReadStrip function's handling of PHOTOMETRIC_YCBCR images. The commit diff shows this function was replaced by _decodeStripYCbCr with added buffer validation (INT_MAX checks, proper row_byte_size calculation, and realloc safety). The NVD description specifically mentions conflicts in RGBA mode handling with LibTIFF, which matches the code changes targeting YCbCr decoding paths in ReadStrip. The added crash test file and modified test parameters further confirm this was the vulnerable code path.