Pillow Vulnerable to Write Buffer Overflow on BCn encoding
At a glance
Severity
HIGH 7.1
EPSS
EPSS 0.32 % · percentile 25 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
GitHub_M
NVD status
Analyzed
Description
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
GHSA-xg8h-j46f-w952 — Pillow vulnerability can cause write buffer overflow on BCn encoding
PYSEC-2025-61 — Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with de
