Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.
Weakness
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pillow | Python | 8.2.0 (including) | 12.3.0 (excluding) |
Potential Mitigations
References
- https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca
- https://github.com/python-pillow/Pillow/pull/9704
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j