CVE-2016-2533: Debian Linux

Medium severity, CVSS 6.5. EPSS: 4% chance of exploitation in the next 30 days.

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only
• Python Pillow: up to and including 3.1.0
• Python Imaging Project Python Imaging: up to and including 1.1.7

Published 2016-04-13. Last modified 2026-06-17.