CVE-2021-28676

Vulnerability

In Pillow versions prior to 8.2.0, the FliDecode function in FliDecode.c did not properly verify that the block advance was non-zero. This flaw allows a specially crafted FLI image file to trigger an infinite loop during image loading. The issue dates back to the PIL fork and was discovered via OSS-Fuzz [1][4].

Exploitation

An attacker can exploit this vulnerability by providing a malicious FLI image file to a user or application that loads it using Pillow. No authentication or special privileges are required; the victim only needs to open the crafted image using Pillow's open() or load() functions. The infinite loop occurs immediately upon processing the image data, consuming CPU resources indefinitely [2][3].

Impact

Successful exploitation results in a denial of service (DoS) condition, as the application becomes unresponsive due to the infinite loop. The attack consumes CPU resources, potentially impacting the availability of the system or service running Pillow. No data integrity or confidentiality is affected [1][3].

Mitigation

This vulnerability is fixed in Pillow version 8.2.0, released on April 1, 2021 [1]. Users should upgrade to Pillow 8.2.0 or later to mitigate the issue. As of the current information, no workarounds are available for older versions [3][4].