BIT-PILLOW-2025-48379 Pillow Vulnerable to Write Buffer Overflow on BCn encoding

🗓️ 03 Jul 2025 05:57:27Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Pillow library versions 11.2.0 to before 11.3.0 vulnerable to heap buffer overflow in DDS format

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	30 Jul 202517:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Aug 2025	29 Aug 202510:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses Pillow is a Python imaging library format due to writing into a buffer.	7 Oct 202516:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in pillow affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	11 Sep 202506:20	–	ibm
BDU FSTEC	The vulnerability of the Pillow image processing library, related to buffer overflow in dynamic memory, allows an attacker to execute arbitrary code.	9 Jan 202600:00	–	bdu_fstec

Source	Link
github	www.github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4
github	www.github.com/python-pillow/Pillow/pull/9041
github	www.github.com/python-pillow/Pillow/releases/tag/11.3.0
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-48379

16 Oct 2025 18:08Current

7.6High risk

Vulners AI Score7.6

CVSS 3.15.5 - 7.1

EPSS0.00269

SSVC

pillow library vulnerability heap buffer overflow dds format untrusted data version 11.3.0