---
id: CVE-2024-28219
aliases:
  - GHSA-44wm-f244-xhp3
  - BIT-pillow-2024-28219
  - PYSEC-2026-1793
title: Pillow buffer overflow vulnerability
summary: Pillow buffer overflow vulnerability
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
vendor: pillow
product: pillow
ecosystem: pip
affected:
  - pillow < 10.3.0
patched:
  - pillow 10.3.0
published: '2024-04-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:11.139712157Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-44wm-f244-xhp3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-28219'
  - url: >-
      https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
  - url: 'https://github.com/python-pillow/Pillow'
  - url: 'https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
  - url: 'https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security'
tags:
  - osv
  - pip
epss: 0.00997
epssPercentile: 0.61117
ingestedAt: '2026-07-08T18:25:45.249Z'
---

## Overview

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

## Affected packages

- `pillow < 10.3.0`

## Remediation

Upgrade to a patched release:

- `pillow 10.3.0`