Pillow Out-of-bounds Read vulnerability

CRITICAL 9.1CVE-2021-25288 · BIT-pillow-2021-25288 · GHSA-rwv7-3v45-hg29 · Published 02/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`≥ 2.4.0, < 8.2.0< 8.2.0`	`8.2.0`
pillow python	`< 8.2.0`	`8.2.0`

Description

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. This dates to Pillow 2.4.0.

NVD description

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.