What is the CVSS score of CVE-2026-28231?

CVE-2026-28231 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-28231?

A critical vulnerability in the pillow_heif Python library (CVSS 9.1) could allow attackers to execute arbitrary code through specially crafted HEIF image files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28231?

Yes, a public proof-of-concept exploit is available for CVE-2026-28231. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-28231?

Within 24 hours: Identify all systems and applications using pillow_heif through dependency scanning and asset inventory. Within 7 days: Apply the available vendor patch to all affected environments and test in staging before production deployment. Within 30 days: Conduct a post-incident review, verify patch deployment across all systems, and implement automated dependency vulnerability monitoring to prevent future gaps.

Python CVE-2026-28231

EUVD-2026-9061 CRITICAL

Out-of-bounds Read (CWE-125)

2026-02-27 security-advisories@github.com

GHSA-5gjj-6r7v-ph3x PYSEC-2026-2248 PYSEC-2026-2258

Denial Of Service Python Information Disclosure Integer Overflow Pillow Heif Suse

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 04, 2026 - 15:55 vuln.today

Public exploit code

Patch released

Mar 04, 2026 - 15:55 nvd

Patch available

CVE Published

Feb 27, 2026 - 20:21 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on pi-heif (1 direct, 0 indirect)
3 pypi packages depend on pillow-heif (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.3.0 and other introduced versions.

DescriptionGitHub Advisory

pillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of _pillow_heif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or denial of service (process crash). No special configuration is required - this triggers under default settings. Version 1.3.0 fixes the issue.

AnalysisAI

Integer overflow in pillow_heif Python library before 1.3.0 leads to out-of-bounds read when processing HEIF images, potentially causing information disclosure or crashes. PoC and patch available.

Technical ContextAI

CWE-125 out-of-bounds read caused by integer overflow in HEIF image dimension handling. pillow_heif is a Pillow plugin for HEIF/HEIC image format support.