CVE-2021-28678

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 8.2.0

Description: An issue was discovered in Pillow where the BlpImagePlugin did not properly check that reads, after jumping to file offsets, returned data for BLP data. This could lead to a denial of service (DoS) where the decoder could be run a large number of times on empty data.

Recommendations: For versions prior to 8.2.0, update to version 8.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the BlpImagePlugin to minimize the risk of exploitation.