Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28231 Heap Out-of-Bounds Read Vulnerability in pillow_heif Python Library Before 1.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28231
Post summary
The text discloses a heap out‑of‑bounds read vulnerability affecting pillow_heif Python library versions older than 1.3.0.
CVE-2026-28231 pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation o… https://www.cve.org/CVERecord?id=CVE-2026-28231
Post summary
The text announces CVE-2026-28231, describing an integer overflow in pillow_heif’s encode path, but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bigcat88 | pillow-heif | - | python | - |