GHSA-XJ96-63GP-2GMR Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger: python from PIL import Image, ImageFilter im = Image.new"L", 3, 3, 128 im.filterImageFilter.MedianFilter4294967295 ImageFilter.RankFilter.filt...

BIT-PILLOW-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ImageFilter.RankFilter process when a very large odd filter size is provided, leading to unchecked signed integer arithmetic in ImagingExpand. An attacker can cause a heap out-of-bounds write by supplying...