Pillow's bundled OpenJPEG carries an unreleased heap-overflow fix
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
- Advisory
- GHSA-78g4-xqwv-q3g8
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 8.1 out of 10, as published
- Affected
- >= 11.1.0 (bundled libopenjp2 2.5.4)
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Image.open and load on a crafted JPEG 2000 file with a Pillow wheel from 11.1.0 onward, whose bundled libopenjp2 2.5.4 lacks the upstream fix for OSV-2025-219.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A JPEG 2000 file is refused by name before Pillow sees it. A patched system OpenJPEG does not help a wheel that bundles its own, which is one more reason to refuse the format by name rather than trust the decoder's version.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade Pillow to a version that has the fix; the upstream record names it.
Specifically. Refuse JPEG 2000 by name, as sillybos does by default.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8
- The record entry, triaged 2026-11-03, last checked 2026-11-03