Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \crafted image file\ approach related to an \Insecure Sign Extension\ issue affecting the ImagingNew in Storage.c component.