Search for vulnerabilities
Vulnerability details: VCID-u2tx-1zrw-e3d1
Vulnerability ID VCID-u2tx-1zrw-e3d1
Aliases BIT-pillow-2020-11538
CVE-2020-11538
GHSA-43fq-w8qq-v88h
PYSEC-2020-80
Summary In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-125 Out-of-bounds Read
CWE-122 Heap-based Buffer Overflow
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
epss 0.00578 https://api.first.org/data/v1/epss?cve=CVE-2020-11538
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.1 https://github.com/advisories/GHSA-43fq-w8qq-v88h
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-43fq-w8qq-v88h
generic_textual CRITICAL https://github.com/advisories/GHSA-43fq-w8qq-v88h
cvssv3.1 8.1 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
cvssv3.1 8.1 https://github.com/python-pillow/Pillow
generic_textual CRITICAL https://github.com/python-pillow/Pillow
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
generic_textual CRITICAL https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
generic_textual CRITICAL https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/pull/4504
generic_textual CRITICAL https://github.com/python-pillow/Pillow/pull/4504
cvssv3.1 8.1 https://github.com/python-pillow/Pillow/pull/4538
generic_textual CRITICAL https://github.com/python-pillow/Pillow/pull/4538
cvssv3.1 8.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
cvssv3.1 8.1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
generic_textual CRITICAL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2020-11538
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2020-11538
cvssv3.1 8.1 https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
generic_textual CRITICAL https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
cvssv3.1 8.1 https://pillow.readthedocs.io/en/stable/releasenotes/index.html
generic_textual CRITICAL https://pillow.readthedocs.io/en/stable/releasenotes/index.html
cvssv3.1 8.1 https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
generic_textual CRITICAL https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
cvssv3.1 8.1 https://usn.ubuntu.com/4430-1
generic_textual CRITICAL https://usn.ubuntu.com/4430-1
cvssv3.1 8.1 https://usn.ubuntu.com/4430-2
generic_textual CRITICAL https://usn.ubuntu.com/4430-2
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
https://api.first.org/data/v1/epss?cve=CVE-2020-11538
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11538
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-43fq-w8qq-v88h
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
https://github.com/python-pillow/Pillow/pull/4504
https://github.com/python-pillow/Pillow/pull/4538
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427/
https://nvd.nist.gov/vuln/detail/CVE-2020-11538
https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
https://usn.ubuntu.com/4430-1
https://usn.ubuntu.com/4430-1/
https://usn.ubuntu.com/4430-2
https://usn.ubuntu.com/4430-2/
1852814 https://bugzilla.redhat.com/show_bug.cgi?id=1852814
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
RHSA-2020:3185 https://access.redhat.com/errata/RHSA-2020:3185
RHSA-2020:3299 https://access.redhat.com/errata/RHSA-2020:3299
RHSA-2020:3302 https://access.redhat.com/errata/RHSA-2020:3302
RHSA-2021:0420 https://access.redhat.com/errata/RHSA-2021:0420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-11538.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-43fq-w8qq-v88h
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-80.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/blob/master/docs/releasenotes/7.1.0.rst#security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/commit/2ef59fdbaeb756bc512ab3f2ad15ac45665b303d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/pull/4504
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/pull/4538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEBCPE4F2VHTIT6EZA2YZQZLPVDEBJGD
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11538
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://snyk.io/vuln/SNYK-PYTHON-PILLOW-574574
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/4430-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/4430-2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6785
EPSS Score 0.00578
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:04.967942+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2020-80.yaml 37.0.0