CVE-2026-28231: BIGCAT88 Pillow-Heif

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required — this triggers under default settings. Version 1.3.0 fixes the issue.

Affected products

• BIGCAT88 Pillow-Heif: before 1.3.0 (fixed in 1.3.0)

Published 2026-02-27. Last modified 2026-06-17.