CVE-2025-48379: Pillow Vulnerable to Write Buffer Overflow on BCn encoding
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48379?
CVE-2025-48379 has a critical severity level due to the potential for a heap buffer overflow.
How do I fix CVE-2025-48379?
To fix CVE-2025-48379, upgrade to pillow version 11.3.0 or later.
Which versions of pillow are affected by CVE-2025-48379?
CVE-2025-48379 affects pillow versions between 11.2.0 and 11.2.0 inclusive.
What types of data are vulnerable in CVE-2025-48379?
CVE-2025-48379 is exploitative when saving untrusted data as compressed DDS images.
What is the underlying cause of CVE-2025-48379?
CVE-2025-48379 is caused by a heap buffer overflow due to insufficient space checks when writing large DDS images.