Search for vulnerabilities
Vulnerability details: VCID-yc15-m42h-quhg
Vulnerability ID VCID-yc15-m42h-quhg
Aliases CVE-2024-28219
GHSA-44wm-f244-xhp3
Summary Pillow buffer overflow vulnerability In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (6)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-676 Use of Potentially Dangerous Function
CWE-680 Integer Overflow to Buffer Overflow
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28219.json
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
epss 0.0017 https://api.first.org/data/v1/epss?cve=CVE-2024-28219
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-44wm-f244-xhp3
cvssv3.1 6.7 https://github.com/python-pillow/Pillow
generic_textual HIGH https://github.com/python-pillow/Pillow
cvssv3.1 6.7 https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
generic_textual HIGH https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
cvssv3.1 6.7 https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
cvssv3.1 6.7 https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
cvssv3.1 6.7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
cvssv3.1 6.7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2024-28219
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-28219
cvssv3.1 6.7 https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
cvssv3.1 6.7 https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
generic_textual HIGH https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
ssvc Track https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28219.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50447
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28219
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/python-pillow/Pillow
https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
https://nvd.nist.gov/vuln/detail/CVE-2024-28219
https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
2272563 https://bugzilla.redhat.com/show_bug.cgi?id=2272563
4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
GHSA-44wm-f244-xhp3 https://github.com/advisories/GHSA-44wm-f244-xhp3
RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781
RHSA-2024:4227 https://access.redhat.com/errata/RHSA-2024:4227
RHSA-2024:5662 https://access.redhat.com/errata/RHSA-2024:5662
USN-6744-1 https://usn.ubuntu.com/6744-1/
USN-6744-2 https://usn.ubuntu.com/6744-2/
USN-6744-3 https://usn.ubuntu.com/6744-3/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28219.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/ Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-28219
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R Found at https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-04-03T18:09:55Z/ Found at https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
Exploit Prediction Scoring System (EPSS)
Percentile 0.27527
EPSS Score 0.00095
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:30:34.604976+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-44wm-f244-xhp3/GHSA-44wm-f244-xhp3.json 37.0.0