# Pillow heap buffer overflow in bundled libopenjp2

Source: https://junglewise.ai/threats/pillow-bundled-libopenjp2-2-5-4-in-all-wheels-since-11-1-0-carries-osv-cd00a842  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.1 · Published 2026-10-22

Pillow, a widely-used Python image processing library, bundles a vulnerable version of the JPEG 2000 decoder that can be exploited through Image.open() with a crafted image file. An attacker can trigger an out-of-bounds heap write, crash the application, or potentially achieve code execution by corrupting heap metadata and hijacking function pointers. This affects any service that processes user-supplied images without strict format validation.

Technologies: [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.1, published 22 October 2026.

**Which products and versions are affected?** Pillow contributors Pillow 11.1.0, 11.2.1, 11.3.0, 12.0.0 through 12.3.0; pillow (PyPI) >= 11.1.0, < 13.0.0, ECOSYSTEM:introduced=11.1.0,fixed=13.0.0.

**Is there a fix for This vulnerability?** Yes. pillow (PyPI): upgrade to 13.0.0 or later. Until then: Apply format allowlist validation to Image.open() by passing the formats= parameter and validating against detected magic bytes rather than client-supplied filename or Content-Type headers, as format sniffing bypasses extension-based checks. Restrict image processing endpoints to accept only necessary formats, explicitly excluding JPEG 2000 if not required.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Pillow contributors Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pillow (PyPI): upgrade to 13.0.0 or later

  ```sh
  pip install "pillow>=13.0.0"
  ```


Apply format allowlist validation to Image.open() by passing the formats= parameter and validating against detected magic bytes rather than client-supplied filename or Content-Type headers, as format sniffing bypasses extension-based checks. Restrict image processing endpoints to accept only necessary formats, explicitly excluding JPEG 2000 if not required.</anigation>
</invoke>

## Technical details

An unguarded array bounds check in libopenjp2 2.5.3 and 2.5.4 allows an out-of-bounds write in opj_j2k_read_sod when processing a maliciously crafted JPEG 2000 codestream. The vulnerability is reachable from Pillow's default Image.open().load() call without requiring non-default decoder options. The defect lies in the bounds-checking of tp_index array access indexed by an attacker-controlled single-byte TPsot field, with a correct guard pattern already present elsewhere in the same file.

## Affected products

- Pillow contributors Pillow 11.1.0, 11.2.1, 11.3.0, 12.0.0 through 12.3.0

## Timeline

- 2026-10-22: disclosed: Vulnerability reported to Pillow
- 2026-02-10: patched: Upstream OpenJPEG fix committed (91d08b11) but not released

## Related threats

- [Pillow heap buffer overflow in TIFF encoder with mismatched geometry tags](https://junglewise.ai/threats/cve-2026-128067-pillow-heap-buffer-overflow-saving-tiff-with-libtiff-when-tags)
- [Pillow memory denial of service in TIFF and EXIF parsing](https://junglewise.ai/threats/cve-2026-128066-pillow-memory-dos-in-tiff-and-exif-ifd-parsing-via-overlapping)
- [Pillow libtiff encoder memory disclosure and crash via crafted TIFF tags](https://junglewise.ai/threats/cve-2026-112902-pillow-memory-disclosure-and-segfault-in-libtiff-encoder-via)
- [Pillow EPS load decompression bomb check bypass in Ghostscript scaling](https://junglewise.ai/threats/cve-2026-112899-pillow-eps-load-scale-lets-ghostscript-render-past-the)
- [Pillow Arrow export memory disclosure via row padding](https://junglewise.ai/threats/cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0)