Search for vulnerabilities
Vulnerability details: VCID-5wm9-zath-x7dy
Vulnerability ID VCID-5wm9-zath-x7dy
Aliases CVE-2019-19911
GHSA-5gm3-px64-rw72
PYSEC-2020-172
Summary There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-190 Integer Overflow or Wraparound
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
epss 0.00757 https://api.first.org/data/v1/epss?cve=CVE-2019-19911
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/advisories/GHSA-5gm3-px64-rw72
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-5gm3-px64-rw72
generic_textual HIGH https://github.com/advisories/GHSA-5gm3-px64-rw72
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
cvssv3.1 7.5 https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
cvssv3.1 7.5 https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-19911
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-19911
cvssv3.1 7.5 https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
generic_textual HIGH https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
cvssv3.1 7.5 https://usn.ubuntu.com/4272-1
generic_textual HIGH https://usn.ubuntu.com/4272-1
cvssv3.1 7.5 https://www.debian.org/security/2020/dsa-4631
generic_textual HIGH https://www.debian.org/security/2020/dsa-4631
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
https://api.first.org/data/v1/epss?cve=CVE-2019-19911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-5gm3-px64-rw72
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
https://nvd.nist.gov/vuln/detail/CVE-2019-19911
https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
https://usn.ubuntu.com/4272-1
https://usn.ubuntu.com/4272-1/
https://www.debian.org/security/2020/dsa-4631
1789540 https://bugzilla.redhat.com/show_bug.cgi?id=1789540
948224 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948224
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19911.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/advisories/GHSA-5gm3-px64-rw72
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-172.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst#622-2020-01-02
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2019-19911
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-19911
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://usn.ubuntu.com/4272-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2020/dsa-4631
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.72311
EPSS Score 0.00757
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:08:07.672451+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2020-172.yaml 37.0.0