CVE-2022-22816

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

• CWE-125

• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.htmlMailing List, Third Party Advisory
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handlingRelease Notes, Vendor Advisory
• https://security.gentoo.org/glsa/202211-10Third Party Advisory
• https://www.debian.org/security/2022/dsa-5053Third Party Advisory
• https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.htmlMailing List, Third Party Advisory
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handlingRelease Notes, Vendor Advisory
• https://security.gentoo.org/glsa/202211-10Third Party Advisory
• https://www.debian.org/security/2022/dsa-5053Third Party Advisory

Published

Jan 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22810A CWE-307: Improper Restriction of Excessive Authentication …9.8
• CVE-2022-22811A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability e…8.1
• CVE-2022-22812A CWE-79: Improper Neutralization of Input During Web Page G…6.1
• CVE-2022-22813A CWE-798: Use of Hard-coded Credentials vulnerability exist…9.8
• CVE-2022-22814The System Diagnosis service of MyASUS before 3.1.2.0 allows…9.8
• CVE-2022-22815path_getbbox in path.c in Pillow before 9.0.0 improperly ini…6.5
• CVE-2022-22817PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation …9.8
• CVE-2022-22818The {% debug %} template tag in Django 2.2 before 2.2.27, 3.…6.1
• CVE-2022-22819NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JB…7.8
• CVE-2022-2282Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2022-22820Due to the lack of media file checks before rendering, it wa…5.5
• CVE-2022-22821NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR Web…4.4