## Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

- 種別: advisory
- 重大度: high
- 関連技術: python
- 公開日時: 2026-10-22T17:01:08.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-78g4-xqwv-q3g8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-78g4-xqwv-q3g8

影響: pip:pillow >= 11.1.0, < 13.0.0 → 13.0.0
Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219 Because the wheel bundles its own copy, a patched host OS does not help. It is reachable from Image.open(fp); im.load() with default settings. I am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users. Note the in…