{"action":"Upgrade pi-heif to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"pi-heif","cve_ids":["CVE-2026-28231"],"ecosystem":"PyPI","epss":0.00727,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-5gjj-6r7v-ph3x","id":"tcs_01M5KF0YPFAS53ZS971W6NZ591","modified_at":"2026-07-20T19:15:27.655329502Z","published_at":"2026-07-20T19:08:04Z","references":["https://osv.dev/vulnerability/GHSA-5gjj-6r7v-ph3x","https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x","https://nvd.nist.gov/vuln/detail/CVE-2026-28231","https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a","https://github.com/bigcat88/pillow_heif","https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0","https://github.com/pypa/advisory-database/tree/main/vulns/pi-heif/PYSEC-2026-2248.yaml","https://github.com/pypa/advisory-database/tree/main/vulns/pillow-heif/PYSEC-2026-2258.yaml"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5gjj-6r7v-ph3x","url":"https://osv.dev/vulnerability/GHSA-5gjj-6r7v-ph3x"}],"summary":"pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read"}