CVE-2020-35654: Fedoraproject Fedora

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only
• Python Pillow: before 8.1.0 (fixed in 8.1.0)

Published 2021-01-12. Last modified 2026-06-17.