Most recent entries from all

BIT-pillow-2025-48379 — Pillow Vulnerable to Write Buffer Overflow on BCn encoding

Affected: Bitnami: pillow

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

CVE-2025-48379 — Pillow Vulnerable to Write Buffer Overflow on BCn encoding

Affected: python-pillow Pillow

GHSA-xg8h-j46f-w952 — Pillow vulnerability can cause write buffer overflow on BCn encoding

Affected: PyPI: pillow

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.

This only affects users who save untrusted data as a compressed DDS image.

* Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded. * Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.

This was introduced in Pillow 11.2.0 when the feature was added.

PYSEC-2025-61

Affected: PyPI: pillow