Most recent entries from all

CVE-2026-28231 — pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read

Affected: bigcat88 pillow_heif

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

GHSA-5gjj-6r7v-ph3x — pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Affected: PyPI: pi-heif, PyPI: pillow-heif

### Summary

An integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings.

### Details

The buffer validation in `_CtxWriteImage_add_plane()`, `_CtxWriteImage_add_plane_la()`, and `_CtxWriteImage_add_plane_l()` uses 32-bit `int` multiplication to check whether the input buffer is large enough:

```c // _pillow_heif.c, lines 158, 344, 449 if (stride_in * height > buffer.len) { PyBuffer_Release(&buffer); PyErr_SetString(PyExc_ValueError, "image plane does not contain enough data"); return NULL; } ```

Both `stride_in` and `height` are declared as `int` (32-bit signed). When their product exceeds `INT_MAX` (2,147,483,647), the multiplication overflows before the comparison with `buffer.len` (which is `Py_ssize_t`, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.

For example, with `stride_in = 196608` (65536 × 3 for RGB) and `height = 65536`: - True product: 12,884,901,888 - `int32` product: 0 (wraps around) - Comparison: `0 > buffer.len` → `false` → check bypassed

After the check is bypassed, the subsequent loop reads beyond the input buffer:

```c for (int i = 0; i <…

PYSEC-2026-2248

Affected: PyPI: pi-heif