An issue exists in Pillow prior to 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
python pillow
fedoraproject fedora 33