PT-2026-22391 · Unknown · Pillow Heif

Kaizawa97 · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-28231

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions pillow heif versions prior to 1.3.0

Description An integer overflow in the encode path buffer validation within pillow heif.c allows an attacker to bypass bounds checks by providing large image dimensions. This can lead to a heap out-of-bounds read, potentially resulting in information disclosure or denial of service. The issue triggers under default settings and does not require any special configuration.

Recommendations Update to pillow heif version 1.3.0 or later.

Exploit

Fix

DoS

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

CVE-2026-28231

GHSA-5GJJ-6R7V-PH3X

OPENSUSE-SU-2026:10285-1

Affected Products

Pillow Heif

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28231.json · Exploit
• https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a · Patch
• https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10285-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28231 · Security Note
• https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0 · Note
• https://suse.com/security/cve/CVE-2026-28231 · Note
• https://twitter.com/VulmonFeeds/status/2027630859835052189 · Twitter Post
• https://twitter.com/CVEnew/status/2027744245914775760 · Twitter Post
• https://t.me/cveNotify/154131 · Telegram Post