FlawAtlas
Search the atlas
CVE-2020-35653 High

CVE-2020-35653

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

Exploit probability 1.5%
Published January 12, 2021
Required by Not available
Last source change August 7, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

39 explicit affected versions

Bitnami pillow
PyPI pillow

76 explicit affected versions

PyPI pillow

76 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities BIT-pillow-2020-35653

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

View original source
Open Source Vulnerabilities GHSA-f5g8-5qq7-938w

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

View original source
Open Source Vulnerabilities PYSEC-2021-69

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

View original source
Open Source Vulnerabilities CVE-2020-35653

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

View original source

05 / REFERENCES

Further evidence