PT-2025-27574 · Pillow+1 · Pillow+1

Radarhere · Published 2025-07-01 · Updated 2025-10-29 · CVE-2025-48379

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pillow versions 11.2.0 through 11.2.x

Description: The issue is a heap buffer overflow that occurs when writing a sufficiently large image in the DDS format. This happens because the library writes into a buffer without checking for available space. The issue only affects users who save untrusted data as a compressed DDS image.

Recommendations: For Pillow versions 11.2.0 through 11.2.x, update to version 11.3.0 to resolve the issue. As a temporary workaround, consider avoiding the saving of untrusted data as compressed DDS images until the update is applied.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

ALT-PU-2025-13082

BDU:2026-00152

BIT-PILLOW-2025-48379

CVE-2025-48379

GHSA-XG8H-J46F-W952

OPENSUSE-SU-2025:15316-1

PYSEC-2025-61

Affected Products

Alt Linux

Pillow

References · 20

• 🔥 https://github.com/python-pillow/Pillow/pull/9041 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48379.json · Exploit
• https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4 · Patch
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15316-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48379 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-61 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48379 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48379 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48379 · Security Note
• https://osv.dev/vulnerability/BIT-pillow-2025-48379 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xg8h-j46f-w952 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00152 · Security Note
• https://github.com/python-pillow/Pillow · Note