CVE-2026-28231 pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read
An integer overflow in pillow_heif allows attackers to trigger heap out-of-bounds reads, leading to information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28231?
CVE-2026-28231 is a medium-severity vulnerability in bigcat88 pillow_heif, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.
Which versions are affected by CVE-2026-28231?
6 open source packages ship an affected version, including pi-heif and pillow-heif. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pi-heif PyPI | All versions | 1.3.0 |
pi-heif PyPI | All versions | 1.3.0 |
pi-heif PyPI | All versions | 1.3.0 |
pillow-heif PyPI | All versions | 1.3.0 |
pillow-heif PyPI | All versions | 1.3.0 |
pillow-heif PyPI | All versions | 1.3.0 |
Linux distribution packages (1)
python-pillow-heif openSUSE:Tumbleweed | All versions | 1.3.0-1.1 |
Products include Bigcat88 Pillow-Heif.
How do I fix CVE-2026-28231?
Upgrade pi-heif to 1.3.0 or later.
Is CVE-2026-28231 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28231 exists.
Sources
Also known as GHSA-5gjj-6r7v-ph3x, PYSEC-2026-2248, PYSEC-2026-2258, openSUSE-SU-2026:10285-1.