Bigcat88 Pillow-heif vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Bigcat88 Pillow-heif: 1 record(s), with affected versions and fixes.cpe:2.3:a:bigcat88:pillow-heif
CVE-2026-28231
Critical · 9.1
CWE-125 Feb 27, 2026
pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.