CVE-2021-25293

Vulnerability

Overview

CVE-2021-25293 is an out-of-bounds read vulnerability in the SGI RLE decoder of the Pillow image processing library (versions prior to 8.1.1). The root cause is the absence of bounds checking in the expandrow function within SGIRleDecode.c. When decoding RLE-compressed scanlines, the code reads bytes from the source buffer without verifying that the pointer remains within the allocated memory region, leading to out-of-bounds access [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted SGI image file. The attack vector is network-based with low complexity, requires no privileges, and only needs user interaction (e.g., opening the image) [3]. By manipulating the RLE offset and length tables in the SGI header, the attacker can cause the decoder to read beyond the intended buffer boundaries during the RLE chunk processing [1][2].

Impact

Successful exploitation can result in a denial of service (application crash) or, in some cases, the disclosure of sensitive memory contents (information leakage) [3][4]. The CVSS score reflects a medium severity, with potential for partial confidentiality and availability impacts.

Mitigation

The issue was addressed in Pillow version 8.1.1, released in March 2021. Users are strongly advised to upgrade to this version or later. No workarounds are available; updating the library is the only reliable fix [4].