PyPI/pillow-heif CVE-2026-28231: critical 9.1, EPSS 0.70%

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Action: Upgrade pillow-heif to 1.3.0 or later.

pip install pillow-heif==1.3.0

Affected

Fixed versions

Sources

• osv: GHSA-5gjj-6r7v-ph3x#PyPI/pillow-heif
• nvd: CVE-2026-28231
• https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x
• https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a
• https://github.com/bigcat88/pillow_heif
• https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0
• https://github.com/pypa/advisory-database/tree/main/vulns/pi-heif/PYSEC-2026-2248.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow-heif/PYSEC-2026-2258.yaml

CVE-2026-28231 · published 2026-07-20T19:08:04Z · modified 2026-07-20T19:15:27.655329502Z · JSON