CVE-2025-48379

Name of the Vulnerable Software and Affected Versions: Pillow versions 11.2.0 through 11.2.x

Description: The issue is a heap buffer overflow that occurs when writing a sufficiently large image in the DDS format. This happens because the library writes into a buffer without checking for available space. The issue only affects users who save untrusted data as a compressed DDS image.

Recommendations: For Pillow versions 11.2.0 through 11.2.x, update to version 11.3.0 to resolve the issue. As a temporary workaround, consider avoiding the saving of untrusted data as compressed DDS images until the update is applied.