CVE-2016-3076: python pillow
Vulnerability summary
CVE-2016-3076 is a medium (CVSS 5.5) vulnerability in python pillow. EPSS estimates a 2.58% chance of exploitation in the next 30 days, higher than 85.2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 24-04-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.58%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.58% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- pillow< 3.2.0-1
Mageia1 product
- python-pillow< 2.6.2-2.5.mga5
PyPI1 product
- pillow≥ 2.5.0, < 3.1.2
Python1 product
- pillow2.5.0 | 2.5.1 | 2.5.2 | 2.5.3 | 2.6.0 | 2.6.0:rc1 | 2.6.1 | 2.6.2 | 2.7.0 | 2.8.0 | 2.8.1 | 2.8.2 | 2.9.0 | 2.9.0:dev0 | 2.9.0:dev1 | 2.9.0:dev2 | 3.0.0 | 3.0.0:rc1 | 3.1.0
Ubuntu1 product
- pillow< 3.1.2-0ubuntu1
5 vendors · 5 products
References
16 links- pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.htmlX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cgi?id=1321929X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryWEBREPORT
