Search for vulnerabilities
Vulnerability details: VCID-uvwy-jm9c-v7ev
Vulnerability ID VCID-uvwy-jm9c-v7ev
Aliases CVE-2016-2533
GHSA-3c5c-7235-994j
PYSEC-2016-19
Summary Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write
System Score Found at
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.01184 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
epss 0.02195 https://api.first.org/data/v1/epss?cve=CVE-2016-2533
cvssv2 5.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.5 https://github.com/advisories/GHSA-3c5c-7235-994j
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3c5c-7235-994j
generic_textual HIGH https://github.com/advisories/GHSA-3c5c-7235-994j
cvssv3.1 6.5 https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
cvssv3.1 6.5 https://github.com/python-pillow/Pillow
generic_textual HIGH https://github.com/python-pillow/Pillow
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
generic_textual HIGH https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
cvssv3.1 6.5 https://github.com/python-pillow/Pillow/pull/1706
generic_textual HIGH https://github.com/python-pillow/Pillow/pull/1706
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2016-2533
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2016-2533
cvssv3.1 6.5 https://security.gentoo.org/glsa/201612-52
generic_textual HIGH https://security.gentoo.org/glsa/201612-52
cvssv3.1 6.5 http://www.debian.org/security/2016/dsa-3499
generic_textual HIGH http://www.debian.org/security/2016/dsa-3499
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2016/02/02/5
generic_textual HIGH http://www.openwall.com/lists/oss-security/2016/02/02/5
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2016/02/22/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2016/02/22/2
cvssv3.1 6.5 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
generic_textual HIGH http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2533.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0740
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0775
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2533
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-3c5c-7235-994j
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9
https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
https://github.com/python-pillow/Pillow/pull/1706
https://nvd.nist.gov/vuln/detail/CVE-2016-2533
https://security.gentoo.org/glsa/201612-52
http://www.debian.org/security/2016/dsa-3499
http://www.openwall.com/lists/oss-security/2016/02/02/5
http://www.openwall.com/lists/oss-security/2016/02/22/2
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
1304504 https://bugzilla.redhat.com/show_bug.cgi?id=1304504
CVE-2016-2533 http://www.cvedetails.com/cve/CVE-2016-2533/
USN-3080-1 https://usn.ubuntu.com/3080-1/
USN-3090-1 https://usn.ubuntu.com/3090-1/
No exploits are available.
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/advisories/GHSA-3c5c-7235-994j
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-19.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst?plain=1#L53
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9#diff-8ff6909c159597e22288ad818938fd6b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4#diff-8ff6909c159597e22288ad818938fd6b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/python-pillow/Pillow/pull/1706
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2533
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/201612-52
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.debian.org/security/2016/dsa-3499
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2016/02/02/5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2016/02/22/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77987
EPSS Score 0.01184
Published At Sept. 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:05:49.364574+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2016-19.yaml 37.0.0