CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library is vulnerable to a heap out-of-bounds write due to improper validation of filter sizes in the public rank-filter API, which can lead to potential memory corruption. This vulnerability can be exploited when processing images with large odd filter sizes, posing a risk of arbitrary code execution. Developers and organizations using versions prior to 12.3.0 should prioritize upgrading to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)