Upstream information

CVE-2026-28231 at MITRE

Description

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required - this triggers under default settings. Version 1.3.0 fixes the issue.

SUSE information

Overall state of this security issue: Analysis

This issue is currently rated as having critical severity.

CVSS v3 Scores
CVSS detail National Vulnerability Database
Base Score 9.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
CVSS v4 Scores
CVSS detail CNA (GitHub)
Base Score 5.5
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User Interaction None
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact Low
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1259172 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • python311-pillow-heif >= 1.3.0-1.1
  • python313-pillow-heif >= 1.3.0-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-10285

SUSE Timeline for this CVE

CVE page created: Fri Feb 27 22:03:25 2026
CVE page last modified: Fri Mar 6 01:43:38 2026