The python-pillow package, a Python image processing library with extensive file format support, contains a buffer overflow vulnerability in the _imagingcms.c source file, tracked as CVE-2024-28219. This vulnerability is classified under CWE-120 (buffer overflow). Red Hat has issued a security advisory (RHSA-2024:4227) describing this issue and providing updated package versions for Red Hat Enterprise Linux 8 and related variants. The advisory rates the severity as moderate and provides instructions for applying the update. No CVSS score is currently assigned in the advisory.

The buffer overflow vulnerability could potentially lead to memory corruption when processing certain image data using the python-pillow library. While the advisory does not specify exploitation details or confirmed impacts beyond the buffer overflow itself, such vulnerabilities can lead to application crashes or potentially arbitrary code execution if exploited. No known exploits in the wild have been reported. The impact is rated moderate by Red Hat Product Security.

Red Hat has released updated python-pillow packages that address this buffer overflow vulnerability. Users of Red Hat Enterprise Linux 8 and related distributions should apply the security update as described in Red Hat advisory RHSA-2024:4227 and the referenced article https://access.redhat.com/articles/11258. Applying this official update is the recommended remediation. Patch status is confirmed as available. No additional mitigation steps are indicated by the vendor.