CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library versions 8.2.0 through 12.2.0 are vulnerable to a memory management flaw in the JPEG2000 decoding process, which can lead to excessive transient memory usage and potential out-of-memory failures when processing specially crafted tiled JPEG2000 files. This vulnerability poses a high risk, particularly for developers and organizations that utilize Pillow for image processing in applications where memory resources are critical. Users should prioritize upgrading to version 12.3.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)