Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS No score.

Timeline

1. 31 Oct 2026, 14:08 UTC First seen by agentprime
2. 31 Oct 2026, 14:08 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-78g4-xqwv-q3g8
• OSV: GHSA-78g4-xqwv-q3g8
• github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8
• github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc
• github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0
• github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad
• github.com/python-pillow/Pillow
• github.com/python-pillow/Pillow/releases/tag/13.0.0
• osv.dev/vulnerability/OSV-2025-219

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.