VYPR
← All advisories
High severityNVD Advisory· Published Apr 3, 2024· Updated Nov 4, 2025

CVE-2024-28219

CVE-2024-28219

Description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Pillow before 10.3.0 has a buffer overflow in _imagingcms.c due to strcpy being used instead of strncpy.

Root

Cause

In Pillow versions prior to 10.3.0, the _imagingcms.c file contained two instances where the strcpy function was used to copy input mode strings into fixed-length buffers. This could lead to a classic buffer overflow if the source string exceeded the destination buffer size, as strcpy performs no bounds checking [2][4].

Exploitation

The vulnerability is triggered when processing crafted ICC profile transform operations with overly long mode strings (e.g., "ABCDEFGHI") [4]. An attacker needs to supply a specially crafted image or ICC profile that, when processed by Pillow's color management functions, causes strcpy to write beyond the allocated buffer. No authentication is required, and the attack can be delivered via any vector that causes Pillow to open a malicious file (such as a user opening an email attachment or visiting a website) [1].

Impact

Successful exploitation results in a buffer overflow, which could corrupt adjacent memory and potentially allow an attacker to achieve arbitrary code execution or cause a denial of service. The overflow occurs within the core C extension module, increasing the severity of the issue [2].

Mitigation

The vulnerability was fixed in Pillow version 10.3.0 by replacing strcpy with strncpy, which limits the number of bytes copied and prevents buffer overruns [2][4]. Users are strongly advised to upgrade to Pillow 10.3.0 or later. Debian LTS users should apply the available security update [1].

References
  1. NVD - CVE-2024-28219
  2. 10.3.0 (2024-04-01)
  3. Use strncpy to avoid buffer overflow · python-pillow/Pillow@2a93aba

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pillowPyPI
< 10.3.010.3.0

Affected products

53

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.