CVE-2026-28231
Integer Overflow in pillow_heif Causes Heap Out-of-Bounds Read
Publication date: 2026-02-27
Last updated on: 2026-03-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bigcat88 | pillow-heif | to 1.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the pillow_heif Python library, which is used for handling HEIF images and acts as a plugin for Pillow. Before version 1.3.0, there is an integer overflow in the encode path buffer validation within the _pillow_heif.c file. This overflow allows an attacker to bypass bounds checks by supplying very large image dimensions.
As a result, this leads to a heap out-of-bounds read, meaning the program reads memory outside the allocated buffer. This can cause sensitive server memory to leak into the encoded images or cause the process to crash.
No special configuration is needed to trigger this vulnerability; it occurs under default settings. The issue was fixed in version 1.3.0 of pillow_heif.
How can this vulnerability impact me? :
This vulnerability can impact you in two main ways:
- Information disclosure: Sensitive server heap memory may leak into encoded images, potentially exposing confidential data.
- Denial of service: The process handling the images may crash due to the heap out-of-bounds read, causing service interruptions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the pillow_heif Python library to version 1.3.0 or later, where the integer overflow issue in the encode path buffer validation has been fixed.
No special configuration is required to trigger the vulnerability, so simply updating the library will prevent exploitation.