CVE-2021-25288

Vulnerability

An out-of-bounds (OOB) read vulnerability exists in the J2kDecode function of Pillow (Python Imaging Library fork) before version 8.2.0. The issue is triggered when decoding JPEG 2000 images (J2k format) that contain multiple bands with different widths for each band — for example, 1 byte for luminance (L) and 4 bytes for alpha (A). This behavior has been present since Pillow 2.4.0 [1][4].

Exploitation

An attacker can craft a J2k image file with bands of varying widths to trigger the OOB read. The attack requires no special network position or authentication; it is a classic file‑based vulnerability where the victim only needs to open the malicious image using Pillow’s J2kDecode. The vulnerability was discovered via OSS‑Fuzz, indicating that a specially crafted file is sufficient to reproduce the read beyond the allocated buffer [1][2].

Impact

Successful exploitation results in an out‑of‑bounds read, which may lead to information disclosure (leaking adjacent memory contents) or a denial‑of‑service (crash) if the read accesses unmapped memory. The attacker does not gain code execution or elevated privileges; the impact is limited to reading memory that should not be accessible or causing a segmentation fault [1][2].

Mitigation

Pillow version 8.2.0, released on 2021‑04‑01, contains the fix for this vulnerability [1]. All users should upgrade to Pillow >= 8.2.0. There is no known workaround for older versions; users unable to upgrade should avoid processing untrusted JPEG 2000 images. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog [3].