CVE-2016-9190: Debian Linux

High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Affected products

• Debian Debian Linux: version 8.0 only
• Python Pillow: up to and including 3.3.1

Published 2016-11-04. Last modified 2026-06-17.