CVE-2020-35655: Fedoraproject Fedora

Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days.

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only
• Python Pillow: from 4.3.0, before 8.1.0 (fixed in 8.1.0)

Published 2021-01-12. Last modified 2026-06-17.