Threats tagged 'bit-pillow-2026-96778'

A heap buffer overflow vulnerability exists in Pillow versions from 9.4.0 up to but not including 13.0.0. The flaw occurs when the JPEG encoder buffer is exactly filled by an ICC profile, allowing an attacker-controlled JPEG comment to overwrite adjacent heap memory. This can lead to process crashes and potentially code execution under certain runtime and heap conditions. The issue is fixed in Pillow version 13.0.0.