CVE-2020-35653
About
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
Rainforest analyst review
A crafted PCX file triggers a buffer over-read in Pillow's PcxDecode because a user-supplied stride value is trusted for buffer math. The risk materializes wherever an application decodes an attacker-supplied image, with the payload being a crash or leakage of adjacent memory rather than code execution.
Pillow is one of the most widely embedded imaging libraries in the Python ecosystem, and it very often arrives as a transitive dependency behind something else. The exposure that matters is any server-side flow that accepts and decodes user-uploaded images, which is exactly where a malicious PCX would be handed to the vulnerable path.
Our angle is dependency inventory, including indirect pulls and the distro-packaged copies in Debian and Fedora, followed by identifying which services actually decode untrusted images. That intersection, vulnerable Pillow plus an image-upload pipeline, is where this deserves priority; elsewhere it's a routine dependency bump.
References
- https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BYVI5G44MRIPERKYDQEL3S3YQCZTVHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF553AMNNNBW7SH4IM4MNE4M6GNZQ7YD/
- https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Related CVEs
Frequently asked questions
What is CVE-2020-35653?
In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
How severe is CVE-2020-35653?
CVE-2020-35653 carries a CVSS 3.1 base score of 7.1, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 70 out of 100, in the high band.
How is CVE-2020-35653 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction Required. Impact on confidentiality Low, integrity None and availability High.
Which products are affected by CVE-2020-35653?
Public advisories list the following as affected: debian linux, fedora, pillow. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2020-35653?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.