CVE-2026-28231 Details
Description
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.
An integer overflow vulnerability has been identified in the Pillow-Heif library, which is used for handling HEIF images in Python. This issue, present in versions prior to 1.3.0, arises from improper buffer validation in the encoding process. The vulnerability allows attackers to bypass bounds checks by specifying large image dimensions, causing a heap out-of-bounds read. This exploitation can result in information disclosure, with server heap memory leaking into encoded images, or a denial-of-service condition by crashing the processing application. The vulnerability triggers under default settings, without requiring any special configuration.
Users can upgrade to Pillow-Heif version 1.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a | [email protected] | Patch |
| https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0 | [email protected] | ProductRelease Notes |
| https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bigcat88 pillow-heif | < 1.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Feb 27, 2026 | New CVE Received | [email protected] |