CVE-2026-28231
Summary
An integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings.
Details
The buffer validation in _CtxWriteImage_add_plane(), _CtxWriteImage_add_plane_la(), and _CtxWriteImage_add_plane_l() uses 32-bit int multiplication to check whether the input buffer is large enough:
// _pillow_heif.c, lines 158, 344, 449
if (stride_in * height > buffer.len) {
PyBuffer_Release(&buffer);
PyErr_SetString(PyExc_ValueError, "image plane does not contain enough data");
return NULL;
}
Both stride_in and height are declared as int (32-bit signed). When their product exceeds INT_MAX (2,147,483,647), the multiplication overflows before the comparison with buffer.len (which is Py_ssize_t, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.
For example, with stride_in = 196608 (65536 × 3 for RGB) and height = 65536:
- True product: 12,884,901,888
- int32 product: 0 (wraps around)
- Comparison: 0 > buffer.len → false → check bypassed
After the check is bypassed, the subsequent loop reads beyond the input buffer:
for (int i = 0; i < height; i++)
memcpy(out + stride_out * i, in + stride_in * i, real_stride);
Additionally, real_stride = width * n_channels (e.g., line 148: real_stride = width * 3) is also computed as int * int, which can independently overflow for large width values.
This vulnerability exists in the encode path, which is distinct from the decode path:
- The decode path is partially guarded by libheif's built-in security limits
- The encode path has no such guards — DISABLE_SECURITY_LIMITS is irrelevant
- The encode path is reachable whenever an application calls pillow_heif
⚡ Watch CVE-2026-28231
Get an email if CVE-2026-28231 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.63% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-28231)