{"id":"CVE-2026-28231","aliases":["PYSEC-2026-2248","GHSA-5gjj-6r7v-ph3x","PYSEC-2026-2258"],"title":"pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the en…","summary":"pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by provid…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","vendor":"pi-heif","product":"pi-heif","ecosystem":"pip","affected":["pi-heif < 1.3.0"],"patched":["pi-heif 1.3.0"],"published":"2026-02-27","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2248","references":[{"url":"https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0"},{"url":"https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a"},{"url":"https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"}],"tags":["osv","pip"],"epss":0.00632,"epssPercentile":0.48905,"ingestedAt":"2026-07-13T18:58:08.508Z","slug":"CVE-2026-28231","body":"## Overview\n\npillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.\n\n## Affected packages\n\n- `pi-heif < 1.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pi-heif 1.3.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}