GHSA-78G4-XQWV-Q3G8: Heap-Based Buffer Overflow in Pillow (libopenjp2)

Vulnerability ID: GHSA-78G4-XQWV-Q3G8
CVSS Score: 7.5
Published: 2026-10-22

A heap-based buffer overflow vulnerability in Pillow PyPI binary wheels (versions 11.1.0 to 12.x) allows remote code execution or application crash via crafted JPEG 2000 files processed by the bundled libopenjp2 library.

TL;DR

Heap buffer overflow write in bundled libopenjp2 during JPEG 2000 parsing in Pillow releases >= 11.1.0. Fixed in Pillow 13.0.0.

Technical Details

CWE ID: CWE-122 (Heap-based Buffer Overflow)
Attack Vector: Network / Remote (Malicious JPEG 2000 file upload)
CVSS Score: 7.5 (High)
EPSS Score: N/A (No CVE assigned)
Impact: Memory Corruption / Remote Code Execution / Denial of Service
Exploit Status: Proof of Concept / OSS-Fuzz Crash Test Case
CISA KEV Status: Not Listed

Affected Systems

Python Pillow PyPI Wheel Packages (11.1.0 to 12.x)
OpenJPEG libopenjp2 (2.5.3, 2.5.4)
Pillow (PyPI Wheels): >= 11.1.0, < 13.0.0 (Fixed in: 13.0.0)
libopenjp2 (OpenJPEG): 2.5.3 - 2.5.4 (Fixed in: 2.5.5)

Code Analysis

Commit: 91d08b1

Fix heap buffer overflow in opj_j2k_read_sod

if (l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index && l_current_tile_part < l_cstr_index->tile_index[p_j2k->m_current_tile_number].nb_tps)

Commit: 5f8114c

Update openjpeg patch for SOD buffer overflow vulnerability

Applied upstream openjpeg 2.5.4 patch to Pillow wheel build workflow

Commit: d3470c3

Update openjpeg build patch in Pillow wheel build scripts

Updated v2.5.4.tar.gz.patch reference

Mitigation Strategies

Upgrade Pillow PyPI packages to version 13.0.0 or higher.
Update underlying host system libopenjp2 shared libraries if building Pillow from source.
Implement strict file format verification to reject JPEG 2000 images if unneeded.

Remediation Steps:

Run pip install --upgrade 'pillow>=13.0.0' in Python application environments.
Verify installed version using python -c 'import PIL; print(PIL.__version__)'.
Restart application services and background task workers to load updated C extension binaries.