CVE-2026-28231

Katalog CVE

CVSS 9.1 · Critical EPSS 0,71%

Kerentanan Out-of-bounds Read pada bigcat88 pillow-heif. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x exploit · mitigasi · advisory vendor
• https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a patch
• https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0 product · release notes