CVE-2026-59197

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1	Patch
https://github.com/python-pillow/Pillow/pull/9695	Issue Tracking Patch
https://github.com/python-pillow/Pillow/releases/tag/12.3.0	Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr	Exploit Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pillow es una biblioteca de procesamiento de imágenes de Python. Antes de la versión 12.3.0, la API pública de filtro de rango de Pillow puede desencadenar una escritura fuera de límites en el heap nativo cuando se le proporciona un tamaño de filtro impar muy grande porque ImageFilter.RankFilter.filter() llama a image.expand(size // 2, size // 2) antes de la validación del tamaño del filtro de rango e ImagingExpand() calcula las dimensiones de salida con aritmética de enteros con signo sin verificar. Este problema está solucionado en la versión 12.3.0.

Information

Published : 2026-07-14 17:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59197

Mitre link : CVE-2026-59197

CVE.ORG link : CVE-2026-59197

JSON object : View

Products Affected

python

pillow

CWE

CWE-190

Integer Overflow or Wraparound

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-59197", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59197", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T18:50:30.849980Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-pillow", "product": "Pillow", "versions": [{"status": "affected", "version": "< 12.3.0"}]}]}], "published": "2026-07-14T17:17:14.487", "references": [{"url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/pull/9695", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0."}, {"lang": "es", "value": "Pillow es una biblioteca de procesamiento de im\u00e1genes de Python. Antes de la versi\u00f3n 12.3.0, la API p\u00fablica de filtro de rango de Pillow puede desencadenar una escritura fuera de l\u00edmites en el heap nativo cuando se le proporciona un tama\u00f1o de filtro impar muy grande porque ImageFilter.RankFilter.filter() llama a image.expand(size // 2, size // 2) antes de la validaci\u00f3n del tama\u00f1o del filtro de rango e ImagingExpand() calcula las dimensiones de salida con aritm\u00e9tica de enteros con signo sin verificar. Este problema est\u00e1 solucionado en la versi\u00f3n 12.3.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6372231F-529B-45CD-978E-3F2AEFF5F95C", "versionEndExcluding": "12.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}