CVE-2022-30595

Vulnerability

A heap buffer overflow vulnerability exists in libImaging/TgaRleDecode.c in Pillow 9.1.0. The flaw occurs when processing invalid TGA image files that use run-length encoding (RLE). The decoder does not properly validate the size of the decoded data against the allocated buffer, leading to a write past the end of the heap buffer. This affects Pillow versions 9.1.0 and earlier [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted TGA image file to an application that uses Pillow to decode it. No authentication or special privileges are required if the application processes user-uploaded images. The attacker crafts a TGA file with malformed RLE data that causes the decoder to write beyond the allocated buffer during decompression [1][2].

Impact

Successful exploitation can lead to heap corruption, potentially resulting in a denial of service (application crash) or arbitrary code execution in the context of the Python process. The exact impact depends on how the application uses Pillow and the memory layout at the time of the overflow [1][3].

Mitigation

The vulnerability is fixed in Pillow 9.1.1, released on 2022-05-25. Users should upgrade to Pillow 9.1.1 or later. No workaround is available for affected versions. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1][3].