Pillow, the Python imaging library, contained a flaw in its JPEG2000 decoder where the per‑tile calculation of the total component width was accumulated across all tiles instead of reset for each tile. This error caused the decoder to allocate a scratch buffer that grew with each tile, potentially reaching memory usage far beyond what the actual image requires. An attacker can exploit this by crafting a tiled JPEG2000 file that forces Pillow to consume a large amount of temporary memory, leading to an out‑of‑memory failure during decoding. The resulting crash or hanging of the process using Pillow manifests as a denial‑of‑service condition for the application.

Python Pillow, versions 8.2.0 through 12.2.0. The library is widely used by Python applications that perform image processing, such as web servers, desktop tools, and automated pipelines.

The CVSS score of 8.7 signals a high severity vulnerability. Although the EPSS score is less than 1%, indicating a small current exploitation probability, the flaw is not listed in the CISA KEV catalog. Attackers would most likely embed a malicious JPEG2000 image in a payload—such as an uploaded file—to trigger excessive memory consumption in a process that imports Pillow. When memory exhaustion occurs, the process may crash or become unresponsive, resulting in a denial of service for the affected application.