PT-2026-64104 · Pypi · Pillow

Published

2026-07-23

·

Updated

2026-07-23

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

src/libImaging/Jpeg2KDecode.c:853 accumulates total component width across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tile bytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state->buffer via realloc at src/libImaging/Jpeg2KDecode.c:876 up to roughly one full image's decompressed size even when each tile is small. A crafted tiled JPEG2000 file can therefore force substantially higher transient memory usage and trigger out-of-memory failures during decoding. Based on current evidence, the supported impact is denial of service, not memory corruption.

Details

  • Location: src/libImaging/Jpeg2KDecode.c:853
  • Root cause: total component width is initialized only once before the tile loop and keeps growing across tiles. It is then used to derive tile bytes, so later tiles are treated as if they had the combined component width of all earlier tiles.
  • Dangerous operation: tile bytes is promoted into tile info.data size, then state->buffer is grown with realloc at src/libImaging/Jpeg2KDecode.c:876.
  • Reachability: any attacker-controlled JPEG2000 image with many tiles reaches this path during normal Image.open(...).load() decoding.

PoC

The attached helper script and testcase were used: [exercise j2k tile realloc.zip](https://github.com/user-attachments/files/28099912/exercise j2k tile realloc.zip)
Generate the testcase:
bash
pythonexercise j2k tile realloc.py make poc 3664 rgba tile1832.jp2 
 --size 3664 --tile 1832
Expected geometry from the helper:
  • image size: 3664 x 3664
  • mode: RGBA
  • tile size: 1832 x 1832 (2x2 tiles)
  • image bytes=53699584
  • uncapped RSS observed:
  • vulnerable build: maxrss kb=180264
  • fixed comparison build: maxrss kb=138404
Load it with the current vulnerable build:
bash
python exercise j2k tile realloc.py load poc 3664 rgba tile1832.jp2
Load it again under a 160 MB address-space cap:
bash
python exercise j2k tile realloc.py load poc 3664 rgba tile1832.jp2 --limit-mb 160

Impact

Conservative impact: denial of service through memory exhaustion during JPEG2000 decoding.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-3496

Affected Products

Pillow