CVE-2025-48379
Fixed in a distro release EPSS <1%CVSS 7.1
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 11.3.0 |
| PyPI | pillow | 89f1f4626a2aaf5f3d5ca6437f41def2998fbe09 |
| PyPI | pillow | ef98b3510e3e4f14b547762764813d7e5ca3c5a4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | python-pillow | 11.3.0-1 |
| Chainguard | kubeflow-pipelines-visualization-server | 2.5.0-r4 |
| Chainguard | open-webui | 0.6.36-r0 |
| Chainguard | open-webui-compat | 0.6.36-r0 |
| Chainguard | pgadmin4 | 9.5-r0 |
| Chainguard | pgadmin4-oci-entrypoint | 9.5-r0 |
| Chainguard | pgadmin4-pg12 | 9.5-r0 |
| Chainguard | pgadmin4-pg13 | 9.5-r0 |
| Chainguard | pgadmin4-pg14 | 9.5-r0 |
| Chainguard | pgadmin4-pg15 | 9.5-r0 |
| Chainguard | pgadmin4-pg16 | 9.5-r0 |
| Chainguard | pgadmin4-pg17 | 9.5-r0 |
| Chainguard | py3-vllm-cuda-12.4 | 0.9.2-r0 |
| Chainguard | py3.10-torchvision-cuda-12.3 | 0.18.1-r7 |
| Chainguard | py3.10-vllm-cuda-11.8 | 0.9.1-r2 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.9.2-r0 |
| Chainguard | py3.10-wheels-torchvision-cuda-12.3 | 0.18.1-r7 |
| Chainguard | py3.10-wheels-vllm-cuda-11.8 | 0.9.1-r2 |
| Chainguard | py3.11-torchvision-cuda-12.3 | 0.18.1-r8 |
| Chainguard | py3.11-wheels-torchvision-cuda-12.3 | 0.18.1-r8 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.9.2-r0 |
| Chainguard | py3.9-torchvision-cuda-11.8 | 0.18.1-r4 |
| Chainguard | py3.9-wheels-torchvision-cuda-11.8 | 0.18.1-r4 |
| Chainguard | superset | 5.0.0-r0 |
| Chainguard | superset-ci | 5.0.0-r0 |
| Chainguard | superset-entrypoint | 5.0.0-r0 |
| Chainguard | superset-iamguarded-compat | 5.0.0-r0 |
| Chainguard | tensorflow-cpu-jupyter | 2.19.0-r6 |
| Chainguard | tensorflow-gpu-jupyter | 2.19.0-r5 |
| Chainguard | tritonserver-backend-vllm-24.04 | 24.04-r13 |
| Ubuntu 22.04 LTS | pillow | no fix |
| Ubuntu 24.04 LTS | pillow | no fix |
| Ubuntu 24.10 | pillow | no fix |
| Ubuntu 25.04 | pillow | no fix |
| Ubuntu Pro 14.04 LTS | pillow | no fix |
| Ubuntu Pro 16.04 LTS | pillow | no fix |
| Ubuntu Pro 18.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow-python2 | no fix |
| Wolfi | kubeflow-pipelines-visualization-server | 2.5.0-r4 |
| Wolfi | open-webui | 0.6.36-r0 |
| Wolfi | open-webui-compat | 0.6.36-r0 |
| Wolfi | superset | 5.0.0-r0 |
| Wolfi | superset-ci | 5.0.0-r0 |
| Wolfi | superset-entrypoint | 5.0.0-r0 |
| Wolfi | superset-iamguarded-compat | 5.0.0-r0 |
| Wolfi | tensorflow-cpu-jupyter | 2.19.0-r6 |
| openSUSE Tumbleweed | python-Pillow | 11.3.0-1.1 |