CVE-2021-25287

Vulnerability

An out-of-bounds read vulnerability exists in the J2kDecode function of Pillow (Python Imaging Library) prior to version 8.2.0. The flaw resides in the j2ku_graya_la unpacker and is reachable when processing JPEG 2000 images with multiple bands (e.g., L and A) where each band may have a different width. This behavior is legal per the JPEG 2000 specification and has been present since Pillow 2.4.0 [1]. The vulnerable code path does not properly validate the total buffer size against the sum of the component byte sizes, leading to an out-of-bounds read during the shuffle stage [4].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted JPEG 2000 image to an application that uses Pillow to decode it. No authentication or special privileges are required; the attacker only needs the ability to supply the malicious image file (e.g., via upload, email, or web service). The issue was discovered via OSS-Fuzz, indicating that the attack vector is network-based with low attack complexity [1][2]. The exploit does not require user interaction beyond the application opening the file.

Impact

Successful exploitation results in an out-of-bounds read of heap memory, which could lead to information disclosure (exposure of sensitive data) or a denial-of-service (application crash). The out-of-bounds read occurs in the context of the Pillow process, and the impact is limited to the data accessible from that process's heap [1][2]. Confidentiality and availability are affected, while integrity is not compromised.

Mitigation

The vulnerability is fixed in Pillow version 8.2.0, released on 2021-04-01 [1]. Users should upgrade to Pillow 8.2.0 or later. The fix includes proper bounds checking in the j2k_decode_entry function to prevent the out-of-bounds read [4]. No workaround is available for affected versions. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of June 2021.