{"action":"Upgrade pi-heif to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"pi-heif","cve_ids":["CVE-2026-28231"],"ecosystem":"PyPI","epss":0.00703,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-5gjj-6r7v-ph3x","id":"tcs_01M5KGYAVBF0NS3X1XR3NEN1DK","modified_at":"2026-07-13T07:26:30.359630077Z","published_at":"2026-02-27T20:21:40.697Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2248","https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0","https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a","https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2248","url":"https://osv.dev/vulnerability/PYSEC-2026-2248"}],"summary":"pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attac"}