CVE-2022-22816

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.htmlMailing List, Third Party Advisory
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handlingRelease Notes, Vendor Advisory
https://security.gentoo.org/glsa/202211-10Third Party Advisory
https://www.debian.org/security/2022/dsa-5053Third Party Advisory
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00018.htmlMailing List, Third Party Advisory
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handlingRelease Notes, Vendor Advisory
https://security.gentoo.org/glsa/202211-10Third Party Advisory
https://www.debian.org/security/2022/dsa-5053Third Party Advisory

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-228179.8PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda CVE-2022-228186.1The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current conte CVE-2022-228197.8NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a CVE-2022-228205.5Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipie CVE-2022-228214.4NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admi CVE-2022-228229.8addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228239.8build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228249.8defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228258.8lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228268.8nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228278.8storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-228287.5An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared