Upgrade Pillow to 13.0.0 to Block Bundled OpenJPEG Heap Overflow

Defenders managing Python environments must address a high-severity vulnerability in the Pillow image processing library. Versions 11.1.0 through 12.3.0 bundle a copy of the OpenJPEG library that contains a heap-buffer-overflow write defect. This flaw exists in the bundled binary regardless of whether the host operating system has patched its own OpenJPEG installation. The vulnerability allows an attacker to write beyond allocated memory boundaries when processing specific image files.

The risk

The defect resides in the opj_j2k_read_sod function within the bundled libopenjp2 source code. According to the GitHub advisory GHSA-78g4-xqwv-q3g8, the code fails to perform null checks or bounds checks on the tp_index array. The index value l_current_tile_part is derived directly from the TPsot field of the SOT marker in the image file. This lack of validation allows out-of-bounds writes. The vulnerability is triggered when an application uses default settings to open and load a crafted JPEG 2000 file.

Who is exposed

Applications using Pillow versions 11.1.0, 11.2.1, 11.3.0, or any version between 12.0.0 and 12.3.0 are affected. These versions bundle OpenJPEG 2.5.3 or 2.5.4, which introduced the bug in a commit dated June 25, 2024. Earlier versions of Pillow, such as 10.4.0 and 11.0.0, bundle OpenJPEG 2.5.2 and remain safe from this specific issue. The exposure is direct because the vulnerable library is shipped inside the Pillow wheel, bypassing system-level protections.

Cost and compliance

No specific CVE ID has been assigned to this vulnerability in the source material. The GitHub advisory classifies the severity as high. The flaw is tracked under OSV-2025-219. There is no mention of financial costs, regulatory fines, or compliance penalties associated with this finding in the provided documentation. The primary cost is the operational effort required to identify and upgrade affected dependencies across development and production environments.

Our take on the response

Pillow version 13.0.0 patches this vulnerability by updating the bundled OpenJPEG library. Teams should verify their current Pillow version and upgrade to 13.0.0 or later. Since the bug was introduced by keeping dependencies current, simply having a recent version does not guarantee safety. Security teams must validate that the bundled library version is not 2.5.3 or 2.5.4. This inversion means that older, stable versions may have been safer than newer ones in this specific case.

What defenders should look for

Teams should monitor for abnormal process behavior in applications that process user-uploaded images. Look for crashes or memory access violations in services that utilize Pillow or similar image libraries. Check logs for unexpected termination signals or segmentation faults when handling JPEG 2000 files. Inspect network traffic for large, unusual image uploads that might contain malicious payloads. Verify that image processing services run with least privilege to limit the impact of potential memory corruption. Ensure that input validation checks file types and sizes before processing.

Background: Input validation

Implement strict allowlists for all external data, enforce type and length constraints, and decode inputs before validation. Reject anything that does not match the exact expected format. This prevents injection attacks and buffer overflows by ensuring only safe, predictable data enters your processing logic.

Read the full guide: Input Validation Best Practices to Stop Exploits at the Edge

What to do and how to stay safe: Pillow

• Audit your Python environments to identify any installations of Pillow versions 11.1.0 through 12.3.0.
• Upgrade all affected Pillow instances to version 13.0.0 or later to obtain the patched OpenJPEG library.
• Implement strict input validation for image uploads to reject malformed or unexpected file formats before processing.
• Monitor application logs for crashes or memory errors related to image processing functions to detect exploitation attempts.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Pillow versions are affected by this vulnerability?

Pillow versions 11.1.0 through 12.3.0 are affected because they bundle vulnerable versions of the OpenJPEG library.

Is there a CVE ID for this vulnerability?

No CVE ID is listed in the source material; it is tracked as GitHub advisory GHSA-78g4-xqwv-q3g8 and OSV-2025-219.

How can I verify if my Pillow installation is vulnerable?

Check your Pillow version; if it is between 11.1.0 and 12.3.0, it is vulnerable. You can also check the bundled OpenJPEG version.