Description
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952
Exploit, Issue Tracking x_refsource_misc
https://github.com/python-pillow/Pillow/pull/9041
Patch x_refsource_misc
https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4
Release Notes x_refsource_misc
https://github.com/python-pillow/Pillow/releases/tag/11.3.0
Scores
CVSS v3
7.1
EPSS
0.0010
EPSS Percentile
27.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-122
Status
published
Products (2)
pypi/pillow
11.2.0 - 11.3.0PyPI
python/pillow
11.2.1
Published
Jul 01, 2025
Tracked Since
Feb 18, 2026