CVE-2016-4009

Critical

Published: 13/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.

Risk Assessment

Attackers may exploit this vulnerability to execute arbitrary code or destabilize the application, potentially leading to data loss or system integrity breaches.

Recommendation

It is recommended to update the Pillow library to version 3.1.1 or later to mitigate this vulnerability.

Original NVD description (English source)

Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.