GHSA-78G4-XQWV-Q3G8: Heap-Based Buffer Overflow in Pillow (libopenjp2)

Security advisory GHSA-78G4-XQWV-Q3G8 details a high-severity heap-based buffer overflow flaw in the Python Imaging Library (Pillow). The flaw originates in the bundled open-source JPEG 2000 codec library, libopenjp2, which is statically linked or packaged within official PyPI pre-compiled binary wheels starting with Pillow version 11.1.0.

When Pillow processes a crafted JPEG 2000 image, the underlying libopenjp2 library fails to validate the index boundaries of a tile-part array before attempting to write metadata into memory. This missing boundary check leads to an out-of-bounds write of 8 bytes on the process heap (Heap-buffer-overflow WRITE 8).

The vulnerability is tracked upstream as OSV-2025-219 and was initially discovered via Google OSS-Fuzz Issue 403673832. Because the affected functionality is accessible through standard image loading methods such as Image.open().load(), any application accepting user-supplied JPEG 2000 images is vulnerable to process memory corruption.

The root cause resides within src/lib/openjp2/j2k.c in the opj_j2k_read_sod function, which processes the Start of Data (SOD) marker in JPEG 2000 codestreams. The parser extracts the current tile-part index (l_current_tile_part) from the tile's tracking structure using l_cstr_index->tile_index[p_j2k->m_current_tile_number].current_tpsno.

During codestream processing, current_tpsno is derived directly from parameters present in preceding TPsot markers in the attacker-controlled image file. In vulnerable releases of libopenjp2 (versions 2.5.3 and 2.5.4), the parser immediately wrote end_header and end_pos values into the tp_index array using l_current_tile_part as the direct array index.

The library failed to verify two critical safety conditions before executing the memory write: first, whether tp_index was properly allocated (non-NULL); second, whether l_current_tile_part was strictly less than nb_tps (the maximum allocated tile-parts capacity). As a consequence, providing an arbitrarily large or invalid tile-part index allows an attacker to corrupt heap memory past the end of the allocated array.

The vulnerable code path within src/lib/openjp2/j2k.c attempts direct array assignments without checking array bounds or pointer validity.

// Vulnerable Code Path in OpenJPEG 2.5.4 (src/lib/openjp2/j2k.c)
OPJ_UINT32 l_current_tile_part =
    l_cstr_index->tile_index[p_j2k->m_current_tile_number].current_tpsno;
 
// Missing bounds validation on l_current_tile_part before access
l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index[l_current_tile_part].end_header
    = l_current_pos;
l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index[l_current_tile_part].end_pos
    = l_current_pos + p_j2k->m_specific_param.m_decoder.m_sot_length + 2;

The upstream fix introduced in OpenJPEG commit 91d08b11a72764f6d199f32fa0c1b1abd4edc2ad adds an explicit guard check confirming tp_index is non-NULL and l_current_tile_part remains within the allocated nb_tps bounds.

// Patched Code Path in OpenJPEG (src/lib/openjp2/j2k.c)
OPJ_UINT32 l_current_tile_part =
    l_cstr_index->tile_index[p_j2k->m_current_tile_number].current_tpsno;
 
// Added guard checks for non-NULL tp_index and index bounds verification
if (l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index &&
        l_current_tile_part <
        l_cstr_index->tile_index[p_j2k->m_current_tile_number].nb_tps) {
    l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index[l_current_tile_part].end_header
        = l_current_pos;
    l_cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index[l_current_tile_part].end_pos
        = l_current_pos + p_j2k->m_specific_param.m_decoder.m_sot_length + 2;
}

Pillow integrated this patch into its build scripts via commits 5f8114c8096b181fae493543cd3837d9f9a971cc and d3470c327840f4c216a1610f30e7091dfd0b97c0, ensuring that the compiled binary wheels bundle patched library sources.

Exploitation requires supplying a specially structured JPEG 2000 file (.jp2 or .j2k) to an application that processes images using Python Pillow. No authentication is required if the target application processes user-uploaded files or remote images.

The attack vector triggers when the application invokes image loading operations that invoke the underlying native library decoder:

from PIL import Image
 
# Opening and loading a crafted JPEG 2000 image triggers opj_j2k_decode
im = Image.open("malicious.jp2")
im.load()  # Invokes C-level decoder: opj_j2k_decode -> opj_j2k_read_sod

When opj_j2k_read_sod processes the Start of Data marker, the out-of-bounds write occurs. An attacker controlling the value of l_current_pos can write 8-byte integers past the boundaries of the allocated heap chunk. While public exploits currently demonstrate denial-of-service through memory corruption crashes, carefully aligned heap grooming could allow arbitrary memory overwrites.

The impact of this vulnerability ranges from application crash (Denial of Service) to arbitrary code execution within the security context of the Python runtime process. Process termination occurs immediately when address sanitizers or heap integrity checks detect the out-of-bounds write.

Applications running automated image transformation pipelines, web application file upload endpoints, or asynchronous background tasks (such as Celery workers) are directly exposed if they accept JPEG 2000 format inputs.

Because pre-compiled PyPI wheel distributions bundle libopenjp2 directly, environments relying strictly on standard pip install pillow without platform-level package management inherit this flaw automatically.

To remediate GHSA-78G4-XQWV-Q3G8, upgrade Pillow to version 13.0.0 or higher. PyPI wheels for Pillow 13.0.0 contain updated and patched versions of libopenjp2.

pip install --upgrade "pillow>=13.0.0"

If Pillow is built from source using system libraries, ensure the host system's libopenjp2 library package contains OpenJPEG commit 91d08b11a72764f6d199f32fa0c1b1abd4edc2ad or update to OpenJPEG version 2.5.5 or later.

If immediate upgrading is not feasible, restrict application input validation rules to block JPEG 2000 image extensions (.jp2, .j2k, .jpf) before calling Pillow parsing functions.