pysec - pysec-2025-61

pysec-2025-61

Vulnerability from pysec

Published

2025-07-01 19:15

Modified

2025-07-07 14:12

Details

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

Impacted products

Name	purl
pillow	pkg:pypi/pillow

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow",
        "purl": "pkg:pypi/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "89f1f4626a2aaf5f3d5ca6437f41def2998fbe09"
            },
            {
              "fixed": "ef98b3510e3e4f14b547762764813d7e5ca3c5a4"
            }
          ],
          "repo": "https://github.com/python-pillow/pillow",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "11.2.0"
            },
            {
              "fixed": "11.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.2.0",
        "11.2.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48379",
    "GHSA-xg8h-j46f-w952"
  ],
  "details": "Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (\u003e64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.",
  "id": "PYSEC-2025-61",
  "modified": "2025-07-07T14:12:46.226030Z",
  "published": "2025-07-01T19:15:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/11.3.0"
    }
  ]
}

CVE-2025-48379 (GCVE-0-2025-48379)

Vulnerability from cvelistv5

Published

2025-07-01 18:33

Modified

2025-07-01 19:42

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

References

URL

Tags

	https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952	x_refsource_CONFIRM
	https://github.com/python-pillow/Pillow/pull/9041	x_refsource_MISC
	https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4	x_refsource_MISC
	https://github.com/python-pillow/Pillow/releases/tag/11.3.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	python-pillow	Pillow	Version: >= 11.2.0, < 11.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T19:42:09.269034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T19:42:22.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.2.0, \u003c 11.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (\u003e64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T18:33:30.687Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/pull/9041",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/pull/9041"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/11.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/11.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xg8h-j46f-w952",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow Vulnerable to Write Buffer Overflow on BCn encoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-48379",
    "datePublished": "2025-07-01T18:33:30.687Z",
    "dateReserved": "2025-05-19T15:46:00.396Z",
    "dateUpdated": "2025-07-01T19:42:22.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-xg8h-j46f-w952

Vulnerability from github

Published

2025-07-01 17:29

Modified

2025-07-02 14:20

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

Pillow vulnerability can cause write buffer overflow on BCn encoding

Details

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.

This only affects users who save untrusted data as a compressed DDS image.

Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded.
Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.

This was introduced in Pillow 11.2.0 when the feature was added.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.2.0"
            },
            {
              "fixed": "11.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-01T17:29:37Z",
    "nvd_published_at": "2025-07-01T19:15:27Z",
    "severity": "HIGH"
  },
  "details": "There is a heap buffer overflow when writing a sufficiently large (\u003e64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. \n\nThis only affects users who save untrusted data as a compressed DDS image. \n\n* Unclear how large the potential write could be. It is likely limited by process segfault, so it\u0027s not necessarily deterministic. It may be practically unbounded. \n* Unclear if there\u0027s a restriction on the bytes that could be emitted. It\u0027s likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16. \n\nThis was introduced in Pillow 11.2.0 when the feature was added.",
  "id": "GHSA-xg8h-j46f-w952",
  "modified": "2025-07-02T14:20:24Z",
  "published": "2025-07-01T17:29:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48379"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/11.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow vulnerability can cause write buffer overflow on BCn encoding"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2025-61

Vulnerability from pysec

CVE-2025-48379 (GCVE-0-2025-48379)

Vulnerability from cvelistv5

ghsa-xg8h-j46f-w952

Vulnerability from github

Tags

Sightings

Nomenclature