CVE-2021-25288
python-pillow: Out-of-bounds read in J2K image reader
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
Se ha detectado un problema en Pillow versiones anteriores a 8.2.0,. Se presenta una lectura fuera de límites en J2kDecode, en la función j2ku_gray_i
There is an out-of-bounds read in J2kDecode in j2ku_gray_i. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.
The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities. Issues addressed include buffer over-read, buffer overflow, denial of service, and out of bounds read vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-17 CVE Reserved
- 2021-06-02 CVE Published
- 2024-08-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://github.com/python-pillow/Pillow/pull/5377#issuecomment-833821470 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Python Search vendor "Python" | Pillow Search vendor "Python" for product "Pillow" | < 8.2.0 Search vendor "Python" for product "Pillow" and version " < 8.2.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||