CVE-2025-48379 — Heap-based Buffer Overflow in Pillow

CWE-122 — Heap-based Buffer Overflow7 documents6 sources
Severity
5.5MEDIUMNVD
CNA7.1
EPSS
0.0%
top 88.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Python PillowPython-pillow Pillow
Timeline
PublishedJul 1

Description

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶PyPIpython/pillow11.2.0 — 11.3.0+2
▶NVDpython/pillow11.2.1
▶CVEListV5python-pillow/pillow>= 11.2.0, < 11.3.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Pillow vulnerability can cause write buffer overflow on BCn encoding↗2025-07-01
▶
OSV
Pillow vulnerability can cause write buffer overflow on BCn encoding↗2025-07-01
▶
OSV
CVE-2025-48379: Pillow is a Python imaging library↗2025-07-01
▶
CVEList
Pillow Vulnerable to Write Buffer Overflow on BCn encoding↗2025-07-01
▶

📋Vendor Advisories

2
Red Hat
python-pillow: pillow: Pillow DDS Heap Buffer Overflow↗2025-07-01
▶
Debian
CVE-2025-48379: pillow - Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there i...↗2025
▶
CVE-2025-48379 — Heap-based Buffer Overflow in Python | cvebase