Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow     when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to     writing into a buffer without checking for available space. This only affects users who save untrusted     data as a compressed DDS image. This issue has been patched in version 11.3.0. (CVE-2025-48379)

Note that Nessus relies on the presence of the package as reported by the vendor.

The detected version of the Pillow Python package, Pillow, is 11.2.x prior to 11.3.0. It is, therefore, affected by a write buffer overflow vulnerability. There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow
    when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to
    writing into a buffer without checking for available space. This only affects users who save untrusted
    data as a compressed DDS image. This issue has been patched in version 11.3.0. (CVE-2025-48379)

ID	Name	Product	Family	Type	Severity
297502	Linux Distros Unpatched Vulnerability : CVE-2025-48379	Nessus	Misc.	Local	medium
241329	Python Library Pillow 11.2.x < 11.3.0 Write Buffer Overflow	Nessus	Misc.	Local	high
428270	SCA: security update for pillow (GHSA-xg8h-j46f-w952)	Tenable Cloud Security	SCA Checks	Local	medium
428270	SCA: security update for pillow (GHSA-xg8h-j46f-w952)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-48379

medium

Tenable Plugins

medium

high

medium

medium