Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Fix availableCritical · CVSS 9.8EPSS 0.56%

Published Oct 22, 2026 · updated Oct 22, 2026

What to do

  1. Upgrade to a fixed version: Pillow 13.0.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIPillow

Vulnerable versions
>= 11.0.0, < 13.0.0
Fixed in
13.0.0

Check your project: pip show Pillow

What changed

  1. Oct 22, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-125 Out-of-bounds Read · CWE-787 Out-of-bounds Write

← All critical vulnerabilities