CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2025-48379
Medium (5.5) in python pillow. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pillow 11.3.0.
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWE
- CWE-122
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python:pillow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xg8h-j46f-w952 | PyPI | pillow | >=11.2.0 <11.3.0 | 11.3.0 |
| PYSEC-2025-61 | PyPI | pillow | >=11.2.0 <11.3.0 | 11.3.0 |