Security · Pillow

A huge rank-filter size writes out of bounds in ImagingExpand

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

What triggers it

image.filter(ImageFilter.MedianFilter(n)) with an enormous odd n.

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

In the filter API, called with a size the program chooses; opening a file never runs it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

In general. Upgrade to Pillow 12.3.0.

Specifically. Not a pre-decode matter: the flaw is in a call that opening a file never makes.

The general advice applies to every row here.