Pillow Heap Buffer Overflow Vulnerability in DDS Image Handling

A heap buffer overflow vulnerability has been identified in the Python imaging library Pillow, specifically in versions 11.2.0 prior to 11.3.0. The issue arises when writing a compressed DDS image that is larger than 64k, as the library fails to check for available buffer space before writing. This vulnerability only affects users who save untrusted data as a compressed DDS image.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, which can commonly result in memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using Pillow version 11.2.0 prior to 11.3.0 and saving a compressed DDS image larger than 64k. This can be done by resizing an image to 440x440 pixels and saving it in a DDS format with a pixel format that compresses the image, such as DXT1.

Remediation

Users can upgrade to Pillow version 11.3.0, where this vulnerability has been patched.