DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-78G4-XQWV-Q3G8: GHSA-78G4-XQWV-Q3G8: Heap-Based Buffer Overflow in Pillow (libopenjp2)

#security #cve #cybersecurity #ghsa

GHSA-78G4-XQWV-Q3G8: Heap-Based Buffer Overflow in Pillow (libopenjp2)

Vulnerability ID: GHSA-78G4-XQWV-Q3G8
CVSS Score: 7.5
Published: 2026-10-22

A heap-based buffer overflow vulnerability in Pillow PyPI binary wheels (versions 11.1.0 to 12.x) allows remote code execution or application crash via crafted JPEG 2000 files processed by the bundled libopenjp2 library.

TL;DR

Heap buffer overflow write in bundled libopenjp2 during JPEG 2000 parsing in Pillow releases >= 11.1.0. Fixed in Pillow 13.0.0.

Technical Details

  • CWE ID: CWE-122 (Heap-based Buffer Overflow)
  • Attack Vector: Network / Remote (Malicious JPEG 2000 file upload)
  • CVSS Score: 7.5 (High)
  • EPSS Score: N/A (No CVE assigned)
  • Impact: Memory Corruption / Remote Code Execution / Denial of Service
  • Exploit Status: Proof of Concept / OSS-Fuzz Crash Test Case
  • CISA KEV Status: Not Listed

Affected Systems

  • Python Pillow PyPI Wheel Packages (11.1.0 to 12.x)
  • OpenJPEG libopenjp2 (2.5.3, 2.5.4)
  • Pillow (PyPI Wheels): >= 11.1.0, < 13.0.0 (Fixed in: 13.0.0)
  • libopenjp2 (OpenJPEG): 2.5.3 - 2.5.4 (Fixed in: 2.5.5)

Code Analysis

Commit: 91d08b1

Fix heap buffer overflow in opj_j2k_read_sod

if (l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index && l_current_tile_part < l_cstr_index->tile_index[p_j2k->m_current_tile_number].nb_tps)
Enter fullscreen mode Exit fullscreen mode

Commit: 5f8114c

Update openjpeg patch for SOD buffer overflow vulnerability

Applied upstream openjpeg 2.5.4 patch to Pillow wheel build workflow
Enter fullscreen mode Exit fullscreen mode

Commit: d3470c3

Update openjpeg build patch in Pillow wheel build scripts

Updated v2.5.4.tar.gz.patch reference
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Pillow PyPI packages to version 13.0.0 or higher.
  • Update underlying host system libopenjp2 shared libraries if building Pillow from source.
  • Implement strict file format verification to reject JPEG 2000 images if unneeded.

Remediation Steps:

  1. Run pip install --upgrade 'pillow>=13.0.0' in Python application environments.
  2. Verify installed version using python -c 'import PIL; print(PIL.__version__)'.
  3. Restart application services and background task workers to load updated C extension binaries.

References

Read the full report for GHSA-78G4-XQWV-Q3G8 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)