Security1 hOctober 23, 2026, 18:30

Pillow libopenjp2 heap overflow found in JPEG 2000 parsing

Vulnerability GHSA-78G4-XQWV-Q3G8 (CVSS 7.5) in Pillow binary wheels 11.1.0–12.x lets a crafted JPEG 2000 file trigger a heap buffer overflow in the bundled libopenjp2, enabling remote code execution or a crash. It is fixed in Pillow 13.0.0 and OpenJPEG 2.5.5.

DEV Community

Open source

Pillow libopenjp2 heap overflow found in JPEG 2000 parsing

CVSS 7.5, CWE-122 heap overflow in JPEG 2000 parsing
Affects Pillow 11.1.0–12.x and libopenjp2 2.5.3–2.5.4
Fixed in Pillow 13.0.0 and OpenJPEG 2.5.5
PoC and OSS-Fuzz crash exist; no CVE assigned

#Pillow#OpenJPEG

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

Security

FreeSWITCH mod_verto heap overflow rated CVSS 9.8

Security

Unbound DNSSEC heap overflow and CoreDNS auth bypass disclosed

Security

Pillow libopenjp2 heap overflow found in JPEG 2000 parsing

F5 BIG-IP APM: critical CVE-2026-94127 heap overflow in OAuth setups

FreeSWITCH mod_verto heap overflow rated CVSS 9.8

Unbound DNSSEC heap overflow and CoreDNS auth bypass disclosed

CVE-2026-8452 in Citrix NetScaler: SAML parsing overflow leads to pre-auth RCE