PyPI/pi-heif CVE-2026-28231: medium, EPSS 0.73%

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Action: Upgrade pi-heif to 1.3.0 or later.

pip install pi-heif==1.3.0

Affected

Fixed versions

Sources

• osv: GHSA-5gjj-6r7v-ph3x
• https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x
• https://nvd.nist.gov/vuln/detail/CVE-2026-28231
• https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a
• https://github.com/bigcat88/pillow_heif
• https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0
• https://github.com/pypa/advisory-database/tree/main/vulns/pi-heif/PYSEC-2026-2248.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow-heif/PYSEC-2026-2258.yaml

CVE-2026-28231 · published 2026-07-20T19:08:04Z · modified 2026-07-20T19:15:27.655329502Z · JSON