CVE-2016-9189: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.

Affected products

• Debian Debian Linux: version 8.0 only
• Python Pillow: up to and including 3.3.1

Published 2016-11-04. Last modified 2026-06-17.