Imaging security watch

The published security flaws in the libraries that decode images and PDFs, what each one takes to trigger, and how to protect a pipeline that opens files it did not make. Kept current from sillybos's advisory record, rebuilt weekly.

Every program that reads scans hands each file to a decoder, and decoders have flaws. In October 2026 Pillow fixed more than thirty at once, several of them reachable by opening a single crafted file. Anyone who runs an OCR pipeline, a thumbnailer or an upload form has the same question each time one is announced: does this reach me, and what do I do?

This page is our answer, written down. It comes from the work behind sillybos, the library that decides whether a file may be opened before any decoder sees it: every advisory on the libraries we watch is fetched weekly, read by a person, and recorded with what triggers it, whether opening a file reaches it, whether a check before decoding would have refused the file, and how to protect yourself with or without that check. The record is public data in the sillybos repository; this page is built from it.

Three things it is not. It is not a vulnerability database: OSV.dev and the GitHub Advisory Database are, and every row links to them. It is not a claim that sillybos prevents everything: a row says refused by default only where a test in the sillybos suite builds the triggering file and proves it is refused, and many rows say plainly that nothing before the decoder can help. And it is not advice to skip upgrading. The first line of every “how to protect yourself” entry is the fixed version.

If you only want the general advice, read Protecting yourself.

What is watched

The libraries below are the ones sillybos's weekly job asks OSV.dev about. A library with a page has advisories in the record; the others are watched and have none recorded yet.

FreeType freetype on Debian

The font renderer, which poppler uses for the text in a PDF and Pillow uses to draw text.

libjpeg-turbo libjpeg-turbo on Debian

The JPEG decoder nearly everything uses, Pillow included.

libpng libpng1.6 on Debian

The reference C library for PNG, used by Pillow, browsers and most image software.

libtiff tiff on Debian

The C library that reads and writes TIFF, the format most archival scans are kept in. Pillow, poppler, ImageMagick and nearly everything else decode TIFF through it.

OpenJPEG openjpeg2 on Debian

The JPEG 2000 codec, bundled inside Pillow's wheels and used by poppler for JPEG 2000 streams inside PDFs.

Pillow pillow on PyPI

The Python image library. Most Python programs that open a JPEG, PNG or TIFF do it with Pillow, Tetrak OCR included; it wraps libjpeg-turbo, libpng, libtiff and the others below.

poppler poppler on Debian

The PDF renderer behind pdftoppm and pdfinfo, which Tetrak OCR and most Python PDF tools call to turn pages into images.

zlib zlib on Debian

The compression library inside PNG and Deflate-compressed TIFF, so a flaw in it reaches every program that opens either.

The advisories

22 recorded · 15 refused by sillybos's default policy · record generated 2026-11-01

Reaches you says how the triggering input gets to the flaw: by opening a file is the one that matters for a pipeline that takes files from outside. What sillybos does is the record's claim, and "refused by default" is only written where a test proves it. Each row links to a page with the trigger, the finding, the tests and the advice in full.

Follow it

New advisories turn up in the RSS feed. The whole record is also published as JSON, with a link to each page here, for anyone who would rather read it by machine; the file it is built from is in the sillybos repository. The site is rebuilt every Monday after the weekly advisory run, and on every change to the record.