CVE-2021-27922: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Python Pillow: before 8.1.1 (fixed in 8.1.1)

Published 2021-03-03. Last modified 2026-06-17.