CVE-2026-59204

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca	Patch
https://github.com/python-pillow/Pillow/pull/9704	Exploit Issue Tracking Patch
https://github.com/python-pillow/Pillow/releases/tag/12.3.0	Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j	Exploit Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pillow es una biblioteca de procesamiento de imágenes de Python. Desde la versión 8.2.0 hasta la 12.2.0, src/libImaging/Jpeg2KDecode.c acumula total_component_width en cada mosaico de una imagen JPEG2000 en lugar de recalcularlo por mosaico, lo que permite que un archivo JPEG2000 en mosaico manipulado fuerce un uso de memoria transitoria sustancialmente mayor y desencadene fallos por falta de memoria durante la decodificación. Este problema se ha solucionado en la versión 12.3.0.

Information

Published : 2026-07-14 16:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59204

Mitre link : CVE-2026-59204

CVE.ORG link : CVE-2026-59204

JSON object : View

Products Affected

python

pillow

CWE

CWE-789

Memory Allocation with Excessive Size Value

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-59204", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59204", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T18:40:47.610956Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-pillow", "product": "Pillow", "versions": [{"status": "affected", "version": ">= 8.2.0, < 12.3.0"}]}]}], "published": "2026-07-14T16:17:02.227", "references": [{"url": "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/pull/9704", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0."}, {"lang": "es", "value": "Pillow es una biblioteca de procesamiento de im\u00e1genes de Python. Desde la versi\u00f3n 8.2.0 hasta la 12.2.0, src/libImaging/Jpeg2KDecode.c acumula total_component_width en cada mosaico de una imagen JPEG2000 en lugar de recalcularlo por mosaico, lo que permite que un archivo JPEG2000 en mosaico manipulado fuerce un uso de memoria transitoria sustancialmente mayor y desencadene fallos por falta de memoria durante la decodificaci\u00f3n. Este problema se ha solucionado en la versi\u00f3n 12.3.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0084B3C9-32CE-4807-B76F-240505E8D3E0", "versionEndExcluding": "12.3.0", "versionStartIncluding": "8.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}