Out-of-bounds Write Affecting pillow package, versions [11.1.0,13.0.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PILLOW-21431493
- published22 Oct 2026
- disclosed22 Oct 2026
- creditthesecguy45
Introduced: 22 Oct 2026
New CVE NOT AVAILABLE CWE-1395 (opens in a new tab)How to fix?
Upgrade pillow to version 13.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Write via the opj_j2k_read_sod function in the bundled OpenJPEG library when processing a malicious JPEG 2000 image. The function writes to tp_index without first verifying that the pointer is non-null and that l_current_tile_part is within the bounds of nb_tps, allowing an out-of-bounds write into heap memory. An attacker can trigger this by supplying a crafted JPEG 2000 file for decoding, potentially achieving arbitrary code execution.