要点
- CVE-2025-48379 は pillow, pillow (python) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.9% より高い）。
- 対処：11.3.0 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| pillow PyPI | ≥ 11.2.0, < 11.3.0
| 11.3.0
|
| pillow | = 11.2.1
| 修正版なし |
概要
There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.
This only affects users who save untrusted data as a compressed DDS image.
- Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded.
- Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.
This was introduced in Pillow 11.2.0 when the feature was added.
NVD の説明
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン