{"id":"ghsa-ghsa-4558-3h8r-v8xp","seq":53429,"kind":"advisory","title":"Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","url":"https://github.com/advisories/GHSA-4558-3h8r-v8xp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4558-3h8r-v8xp","summary":"影響: pip:Pillow <= 12.3.0 → 13.0.0\nSummary On main, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derives the line size from the bits per pixel c state->bytes = (state->xsize state->bits + 7) / 8; and uses it both for the bounds check and to advance to the next line. For P;2L and P;4L, bits is 2 and 4 re…","severity":"medium","techs":["python"],"cves":["CVE-2026-112394"],"tags":["GHSA-4558-3h8r-v8xp","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T20:00:32.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}