CyberRota Analysis
AI-GeneratedThe Pillow imaging library prior to version 12.3.0 is vulnerable to controlled native heap corruption when the ImageCms.ImageCmsTransform.apply API is used with an output image that has a mismatched mode. This flaw can lead to potential exploitation, allowing attackers to manipulate memory and execute arbitrary code. Developers and organizations using Pillow for image processing should prioritize upgrading to version 12.3.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)