Most recent entries from all

bdu:2026-00152

BIT-pillow-2025-48379 — Pillow Vulnerable to Write Buffer Overflow on BCn encoding

Affected: Bitnami: pillow

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

BREW-pillow-CVE-2025-48379 — Pillow Vulnerable to Write Buffer Overflow on BCn encoding

Affected: Homebrew: pillow

EUVD-2026-246295

fkie_cve-2025-48379

GHSA-xg8h-j46f-w952 — Pillow vulnerability can cause write buffer overflow on BCn encoding

Affected: PyPI: pillow

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.

This only affects users who save untrusted data as a compressed DDS image.

* Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded. * Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.

This was introduced in Pillow 11.2.0 when the feature was added.

openSUSE-SU-2025:15316-1 — python311-Pillow-11.3.0-1.1 on GA media

python311-Pillow-11.3.0-1.1 on GA media

PYSEC-2025-61

Affected: PyPI: pillow

RHSA-2025:15832 — Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)

vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service python-pillow: pillow: Pillow DDS Heap Buffer Overflow

Withdrawn: UBUNTU-CVE-2025-48379

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.10: pillow, Ubuntu:24.04:LTS: pillow, Ubuntu:25.04: pillow