Medium, CVSS 5.5PyPIAmendedPublished
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
CVE-2026-28231 · GHSA-5gjj-6r7v-ph3x
- Affected
- PyPI pillow-heif < 1.3.0
- Fixed in
- 1.3.0· Vendor fix available
- Issue
- An integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Details The buffer validation in CtxWriteImageaddplane(), CtxWriteImageaddplanela(), and CtxWriteImageaddplanel() uses 32-bit int multiplication to check whether the input buffer is large enough: Both stridein and height are declared as int (32-bit signed). When their product exceeds INTMAX (2,147,483,647), the multiplication overflows before the comparison with buffer.len (which is Pyssizet, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly. For example, with stridein = 196608 (65536 × 3 for RGB) and height = 65536: - True…
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.