diff --git a/pkgs/development/python-modules/pillow/7.2.0-CVE-2021-25289.patch b/pkgs/development/python-modules/pillow/7.2.0-CVE-2021-25289.patch
new file mode 100644
index 000000000000..d6c1c442c3bc
--- /dev/null
+++ b/pkgs/development/python-modules/pillow/7.2.0-CVE-2021-25289.patch
@@ -0,0 +1,28 @@
+Based on 3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c, modified to apply cleanly
+
+diff --git a/Tests/test_tiff_crashes.py b/Tests/test_tiff_crashes.py
+index d0de4b305d..eb25334669 100644
+--- a/Tests/test_tiff_crashes.py
++++ b/Tests/test_tiff_crashes.py
+@@ -24,6 +24,8 @@
+         "Tests/images/crash_1.tif",
+         "Tests/images/crash_2.tif",
+         "Tests/images/crash-2020-10-test.tif",
++        "Tests/images/crash-1152ec2d1a1a71395b6f2ce6721c38924d025bf3.tif",
++        "Tests/images/crash-0e16d3bfb83be87356d026d66919deaefca44dac.tif",
+     ],
+ )
+ @pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data")
+diff --git a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c
+index 7f14b5a34c..2f92824c3b 100644
+--- a/src/libImaging/TiffDecode.c
++++ b/src/libImaging/TiffDecode.c
+@@ -239,7 +239,7 @@ _decodeStripYCbCr(Imaging im, ImagingCodecState state, TIFF *tiff) {
+         img.row_offset = state->y; 
+         rows_to_read = min(rows_per_strip, img.height - state->y);
+ 
+-        if (TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read) == -1) {
++        if (!TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read)) {
+             TRACE(("Decode Error, y: %d\n", state->y ));
+             state->errcode = IMAGING_CODEC_BROKEN;
+             goto decodeycbcr_err;
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 0ef73143b651..bca6f33f1a35 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -49,6 +49,43 @@ buildPythonPackage rec {
       url = "https://github.com/python-pillow/Pillow/commit/9a2c9f722f78773e608d44710873437baf3f17d1.patch";
       sha256 = "15dhzd3i8xwx2iaff2qp6z3h0b2yrzcmqi6x7ngld96805gf7v2q";
     })
+    ./7.2.0-CVE-2021-25289.patch
+    (fetchpatch {
+      name = "CVE-2021-25290.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/86f02f7c70862a0954bfe8133736d352db978eaa.patch";
+      sha256 = "0rwwbkqj10p7r2877nx4x3qwrfgrjww8p05wyvvvvfqp1yv63vxh";
+    })
+    (fetchpatch {
+      name = "CVE-2021-25291.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/cbdce6c5d054fccaf4af34b47f212355c64ace7a.patch";
+      sha256 = "1fr3mgb57j8qyfcl3cxrc18y3g4ry6pgl7n6whi7h1wnk40ggar6";
+    })
+    (fetchpatch {
+      name = "CVE-2021-25292.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/3bce145966374dd39ce58a6fc0083f8d1890719c.patch";
+      sha256 = "0bsjw2d9d3z6crawqncvjdvsnk37s05km1b7s6qb035jgzgqlxqx";
+    })
+    (fetchpatch {
+      name = "CVE-2021-25293.prerequisite-1.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/46b7e86bab79450ec0a2866c6c0c679afb659d17.patch";
+      sha256 = "1z0g64pdfzw20zmfwbfkpw327a2la9z8v65dcbqx3yanm08ispy2";
+      includes = ["src/libImaging/SgiRleDecode.c"];
+    })
+    (fetchpatch {
+      name = "CVE-2021-25293.prerequisite-2.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/1cbb12fb6e44da0d6d6d58254d0d96930d04af5e.patch";
+      sha256 = "0nq8ps5g8b4qrhvla5kq38p56cj28fjsyyxap4x0gqk7wcmvkyy9";
+    })
+    (fetchpatch {
+      name = "CVE-2021-25293.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/4853e522bddbec66022c0915b9a56255d0188bf9.patch";
+      sha256 = "1p74ynanbamf88w4wzf1gm2wd7gy6h3y8qdmijz14f1z4dy8yv9g";
+    })
+    (fetchpatch {
+      name = "CVE-2021-27921.CVE-2021-27922.CVE-2021-27923.patch";
+      url = "https://github.com/python-pillow/Pillow/commit/480f6819b592d7f07b9a9a52a7656c10bbe07442.patch";
+      sha256 = "0d7797g0lib3szz5w41b7winpdxcnbf35y4fpyklb49f753wl972";
+    })
   ];
 
   # patching mechanism doesn't work with binary files, but the commits contain
@@ -84,6 +121,91 @@ buildPythonPackage rec {
       sha256 = "0is0r49pbaxy8mgp5fdlx9hm7zdp64ij38hzgnjj9pzxxdrcw3qk";
       path = "Tests/images/ossfuzz-5730089102868480.sgi";
     }
+    { # needed by 7.2.0-CVE-2021-25289.patch
+      commit = "3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c";
+      sha256 = "1lb1442x4yf013h4l37qi4p0zlrqb708d0ng69c76rdnzzfqs8yl";
+      path = "Tests/images/crash-0e16d3bfb83be87356d026d66919deaefca44dac.tif";
+    }
+    { # needed by 7.2.0-CVE-2021-25289.patch
+      commit = "3fee28eb9479bf7d59e0fa08068f9cc4a6e2f04c";
+      sha256 = "1ghxilrr5mash6cbladwrxa9sdqs93z0c3d24ixx0di5qmddhfwv";
+      path = "Tests/images/crash-1152ec2d1a1a71395b6f2ce6721c38924d025bf3.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "1d1zv60l90sik9niwqb07ww6nhvy14yl6p8cj6ksnmgm7qdf58vd";
+      path = "Tests/images/crash-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "141yp5bwc0r07samc1vgjdv07kshr6hl9raxs47zhfvab0vpbfd4";
+      path = "Tests/images/crash-1185209cf7655b5aed8ae5e77784dfdd18ab59e9.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "0jnj5phyv3rlbqvlhk2cxkis1l44b45g7jxzf6fgy8xgpdyaxb2m";
+      path = "Tests/images/crash-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "18m6x3y8ps5b6lqf94mwja5fpv22bdljpha2fggx2nsnrlkaxh4a";
+      path = "Tests/images/crash-4f085cc12ece8cde18758d42608bed6a2a2cfb1c.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "0fi8aqv3rxjvgkvfmqsg7kd0gb9nv7icwc6ng1ydy55da8gwb6f6";
+      path = "Tests/images/crash-86214e58da443d2b80820cff9677a38a33dcbbca.tif";
+    }
+    { # needed by CVE-2021-25290.patch
+      commit = "86f02f7c70862a0954bfe8133736d352db978eaa";
+      sha256 = "08c5rnqgmkasfqzmf7n1nqdcy5pacsyjpgc3ybysnwnac592kfsj";
+      path = "Tests/images/crash-f46f5b2f43c370fe65706c11449f567ecc345e74.tif";
+    }
+    { # needed by CVE-2021-25291.patch
+      commit = "cbdce6c5d054fccaf4af34b47f212355c64ace7a";
+      sha256 = "0x4apm0cg03kk88815b233c7yh80pvm8n7ryal793jxd9qw20583";
+      path = "Tests/images/crash-63b1dffefc8c075ddc606c0a2f5fdc15ece78863.tif";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "1c7dg1nxcgald6yfy651pw0lbv7l17j90rxjahw8h3vrczbwxicc";
+      path = "Tests/images/crash-465703f71a0f0094873a3e0e82c9f798161171b8.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "07mdcnq2x7za84ivxxmcxm5532vpk1z78bzq22ks0cv2gkpviflc";
+      path = "Tests/images/crash-64834657ee604b8797bf99eac6a194c124a9a8ba.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "1ia32p8zmm83gqc3655rrzzqnq4b0zyfnqgfmf07nw7pvnv2nq39";
+      path = "Tests/images/crash-754d9c7ec485ffb76a90eeaab191ef69a2a3a3cd.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "0m5b48cqss0jmnkw54h9jdxakbw3y6bxqgzmcl9wk77anq8czdff";
+      path = "Tests/images/crash-abcf1c97b8fe42a6c68f1fb0b978530c98d57ced.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "0k145flxrxay4s5dqvy1avzzs4bdy33c1by9qbgbzcvj7nhpsynm";
+      path = "Tests/images/crash-b82e64d4f3f76d7465b6af535283029eda211259.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "0ryv73b2mja4chxaszjlxb9r7h4jxmlc7lqvaxz83fhqisp32wll";
+      path = "Tests/images/crash-c1b2595b8b0b92cc5f38b6635e98e3a119ade807.sgi";
+    }
+    { # needed by CVE-2021-25293.patch
+      commit = "4853e522bddbec66022c0915b9a56255d0188bf9";
+      sha256 = "0c8qh3qyqw53wvkkkgpbhxcz72rjw2yxm8wb1s78mys78a7d83ai";
+      path = "Tests/images/crash-db8bfa78b19721225425530c5946217720d7df4e.sgi";
+    }
+    { # needed by CVE-2021-27921.CVE-2021-27922.CVE-2021-27923.patch
+      commit = "480f6819b592d7f07b9a9a52a7656c10bbe07442";
+      sha256 = "1y6317hfvmlcnkbf2qy6a7i8zxgydi9s8lagb21fn2a3k1igymha";
+      path = "Tests/images/oom-8ed3316a4109213ca96fb8a256a0bfefdece1461.icns";
+    }
   ];
 
   # Disable imagefont tests, because they don't work well with infinality: