CVE-2021-28675

Vulnerability

The vulnerability resides in PsdImagePlugin.PsdImageFile._open() in Pillow before version 8.2.0. The code did not validate that the number of input layers (read from the file header) is consistent with the size of the layer data block. This allows an attacker to craft a PSD file with a large layer count but a small data block, causing excessive processing or memory allocation during Image.open(). The issue has been present since the PIL fork. [1][2]

Exploitation

An attacker needs to supply a specially crafted PSD file to a Pillow application that calls Image.open(). The file is parsed during the open() call, and the missing sanity check leads to a denial-of-service condition. No authentication or special privileges are required; the attack vector is network-based if the application processes user-uploaded images. [1][2]

Impact

Successful exploitation results in a denial-of-service (DoS) on the open() call, potentially causing high CPU or memory consumption, crashing the application, or making it unresponsive. No data disclosure or code execution is reported. [1][2]

Mitigation

The issue is fixed in Pillow 8.2.0, released on 2021-04-01. The fix adds a sanity check in _layerinfo() to ensure the layer block is long enough for the claimed number of layers. Users should upgrade to Pillow 8.2.0 or later. No workaround is available for older versions. [2][4]