The Pillow library implements a number of image format decoders, including the P;2L and P;4L raw modes. In versions prior to 13.0.0 the decoder calculates a packed‑pixel row size that is smaller than the actual buffer footprint used by the unpackers. When a caller provides a buffer and image dimensions that accept a smaller size, the unpackers may read one to three bytes past the end of the input buffer, exposing adjacent heap data or causing a crash. This is an instance of a buffer over‑read (CWE‑126) that can lead to inadvertent disclosure of heap memory or denial of service through process termination.

The vulnerability affects the Pillow project, specifically the Pillow library distributed under the python‑pillow vendor. All releases before 13.0.0 are susceptible, regardless of operating system or Python version. Any application that loads and decodes images using the P;2L or P;4L raw decoders before the 13.0.0 release is impacted. The affected product is Pillow, a widely used imaging library in Python projects.

With a CVSS score of 6.3 the vulnerability is considered moderate. The EPSS score is not available, so the current probability of exploitation is uncertain; however, because any application that processes user supplied images can trigger the flaw, the broad exposure of Pillow in many code bases raises concern. The flaw is not listed in the CISA KEV catalog, implying no confirmed field‑deployed exploits yet. Because the impact is limited to leaking a few bytes of heap data or crashing the process, the risk is mainly confidentiality loss and service interruption for the target application, but it is not a remote code execution vector.