CVE-2026-28231
pillow_heif is a Python library for working with HEIF images and plugin for Pillow.
Published Feb 27, 2026 · updated Jun 17, 2026 · bigcat88 pillow-heif
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 27, 2026 · NIST NVD
Detected
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (p
Jun 17, 2026 · NIST NVD
Updated
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (p
Affected
- cpe bigcat88/pillow-heifversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28231
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28231
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a
nvd.nist.gov