Technical impact
Pillow, the Python imaging library, contains a heap over‑read vulnerability in its Windows‑only WMF/EMF renderer. The rendering code accepts 32-bit image dimensions but truncates them to 16 bits when allocating the destination raster, while copying pixel data using the full 32‑bit values. A crafted “wide, short” metafile that passes the decompression‑bomb check can trigger a buffer over‑read, potentially leaking sensitive memory contents or causing a process crash. The flaw is a classic unchecked “read over allocation” error (CWE‑125).
Affected Systems
The flaw exists in the Pillow library (python‑pillow:Pillow) for Windows builds on all versions before 13.0.0. Version 13.0.0 and later contain the fix and are not affected.
Risk and Exploitability
The CVSS score for this issue is 7.1, indicating a high‑severity risk. The EPSS score is not available, so the measured likelihood of exploitation is uncertain, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote or local exploitation via a crafted WMF or EMF file that an application processes with Pillow on Windows; the attacker can supply or inject such a file to read memory or crash the target process.
Github GHSA