CVE-2025-48379

A critical vulnerability was identified in the Pillow image processing library. This flaw could allow a local attacker to execute arbitrary code or cause the application to crash, resulting in a denial of service. An attacker can exploit this vulnerability by tricking an application into processing a specially crafted image file. The issue occurs because the library writes more data than an allocated memory buffer can hold, leading to memory corruption.

This vulnerability was rated as Important by the Red Hat Product Security Engineer. An attacker may leverage that by crafting a malicious DDS image bigger than 64k (when encoded). This happens because of the lack of size checking when writing the image data into an internal buffer. When successfully exploited, this vulnerability may lead to a local arbitrary code execution within the user privileges similar to the ones for the user running the application or a denial of service for the application consuming the Pillow library.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.