{"id":"ghsa-ghsa-78g4-xqwv-q3g8","seq":309548,"kind":"advisory","title":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()","url":"https://github.com/advisories/GHSA-78g4-xqwv-q3g8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-78g4-xqwv-q3g8","summary":"影響: pip:pillow >= 11.1.0, < 13.0.0 → 13.0.0\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219 Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from Image.open(fp); im.load() with default settings. I am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users. Note the in…","severity":"high","techs":["python"],"cves":[],"tags":["GHSA-78g4-xqwv-q3g8","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T17:01:08.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}