PyPI/pillow: high 8.1

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Action: Upgrade pillow to 13.0.0 or later.

pip install pillow==13.0.0

Affected

Fixed versions

Sources

• osv: GHSA-78g4-xqwv-q3g8
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8
• https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc
• https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0
• https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://osv.dev/vulnerability/OSV-2025-219

published 2026-10-22T17:01:08Z · modified 2026-10-22T17:15:04.326552524Z · JSON