GHSA-78G4-XQWV-Q3G8: Heap-Based Buffer Overflow in Pillow (libopenjp2)

Vulnerability ID: GHSA-78G4-XQWV-Q3G8

CVSS Score: 7.5

Published: 2026-10-22

A heap-based buffer overflow vulnerability in Pillow PyPI binary wheels (versions 11.1.0 to 12.x) allows remote code execution or application crash via crafted JPEG 2000 files processed by the bundled libopenjp2 library.

TL;DR

Heap buffer overflow write in bundled libopenjp2 during JPEG 2000 parsing in Pillow releases >= 11.1.0. Fixed in Pillow 13.0.0.

Technical Details

CWE ID : CWE-122 (Heap-based Buffer Overflow)

Attack Vector : Network / Remote (Malicious JPEG 2000 file upload)

CVSS Score : 7.5 (High)

EPSS Score : N/A (No CVE assigned)

Impact : Memory Corruption / Remote Code Execution / Denial of Service

Exploit Status : Proof of Concept / OSS-Fuzz Crash Test Case

CISA KEV Status : Not Listed

Affected Systems

Python Pillow PyPI Wheel Packages (11.1.0 to 12.x)

OpenJPEG libopenjp2 (2.5.3, 2.5.4)

Pillow (PyPI Wheels) : >= 11.1.0, < 13.0.0 (Fixed…