CVE-2021-25289: Python Pillow

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

Affected products

• Python Pillow: before 8.1.1 (fixed in 8.1.1)

Published 2021-03-19. Last modified 2026-06-17.