48 matches found
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
Summary An integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure server heap memory leaking into encoded images or denial...
iscc-sdk (>=0.6.0, <=0.6.2) potentially affected by CVE-2026-28231 via pillow-heif (0.14.0)
pillow-heif PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - iscc-sdk =0.6.0, =0.6.2 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
img-to-pdf (1.0.2) potentially affected by CVE-2026-28231 via pillow-heif (0.15.0)
pillow-heif PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - img-to-pdf 1.0.2 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
maihem-poc (>=0.1.2, <=1.0.1) potentially affected by CVE-2026-28231 via pillow-heif (0.17.0)
pillow-heif PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - maihem-poc =0.1.2, =1.0.1 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
datadreamer (>=0.2.2, <=0.2.3), internal-rdbms (>=0.1.21, <=0.1.49) +5 more potentially affected by CVE-2026-28231 via pillow-heif (0.21.0)
pillow-heif PYPI version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - datadreamer =0.2.2, =0.1.21, =25.4.0, =0.1.0, =0.1.1, =1.0.1 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
indexdoc-converter (>=0.2.4, <=0.2.7), pdd-cli (>=0.0.70, <=0.0.250) +2 more potentially affected by CVE-2026-28231 via pillow-heif (>=1.1.0, <=1.2.0)
pillow-heif PYPI version =1.1.0, =0.2.4, =0.0.70, =0.4.0, =0.0.11, =0.0.33 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
duplicate-images (0.6.0) potentially affected by CVE-2026-28231 via pillow-heif (0.5.1)
pillow-heif PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images 0.6.0 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
duplicate-images (>=0.6.1, <=0.6.2) potentially affected by CVE-2026-28231 via pillow-heif (0.6.1)
pillow-heif PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.6.1, =0.6.2 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
realnet (>=0.0.79, <=0.0.114) potentially affected by CVE-2026-28231 via pillow-heif (0.7.0)
pillow-heif PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - realnet =0.0.79, =0.0.114 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
duplicate-images (>=0.6.3b0, <=0.8.2) potentially affected by CVE-2026-28231 via pillow-heif (0.7.2)
pillow-heif PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.6.3b0, =0.8.2 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
imgtools-cli (>=1.0.3, <=1.0.8) potentially affected by CVE-2026-28231 via pillow-heif (0.9.0)
pillow-heif PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - imgtools-cli =1.0.3, =1.0.8 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
duplicate-images (>=0.8.3, <=0.10.5), flushai (1.0.5) +2 more potentially affected by CVE-2026-28231 via pillow-heif (0.13.1)
pillow-heif PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - duplicate-images =0.8.3, =0.3.1, =0.1.0, =0.1.7 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
agentic-doc (>=0.0.1, <=0.0.18), background-remover-model (1.0.1) +6 more potentially affected by CVE-2026-28231 via pillow-heif (0.16.0)
pillow-heif PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - agentic-doc =0.0.1, =0.0.1, =0.1.0a0, =9.1.0, =0.2.64, =1.1.20 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
ngits-users (2.1.0), wisup-e2m (>=0.1.0, <=0.1.61) potentially affected by CVE-2026-28231 via pillow-heif (0.18.0)
pillow-heif PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - ngits-users 2.1.0 - wisup-e2m =0.1.0, =0.1.61 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
alertwise (1.0.0) potentially affected by CVE-2026-28231 via pillow-heif (0.20.0)
pillow-heif PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - alertwise 1.0.0 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...
11x-wagtail-blog (>=0.0.0, <=0.2.0), anyvec (0.1.3) +61 more potentially affected by CVE-2026-28231 via pillow-heif (0.22.0)
pillow-heif PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - 11x-wagtail-blog =0.0.0, =3.0.0, =5.2.0, =1.0.0, =2.0.0, =2.30.0, =0.1.0a1, =1.0.0.dev0, =0.4.0a0, =4.0.0, =0.7.0, =0.7.2 and more Source...
indexdoc-converter (>=0.2.4, <=0.2.7), pdd-cli (>=0.0.70, <=0.0.250) +2 more potentially affected by CVE-2026-28231 via pillow-heif (>=1.1.0, <=1.2.0)
pillow-heif PYPI version =1.1.0, =0.2.4, =0.0.70, =0.4.0, =0.0.11, =0.0.33 Source cves: CVE-2026-28231 Source advisory: GHSA-5GJJ-6R7V-PH3X...
EUVD-2026-9061
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read...
SUSE CVE-2026-28231
pillowheif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds rea...
