CVE-2026-59205: python-pillow pillow Out-of-bounds Write
Vulnerability summary
CVE-2026-59205 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in python-pillow pillow. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPillow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard15 products
- label-studio< 1.23.0-r11
- lmcache-cuda-12.8< 0.5.3-r0
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.10.2-r1 | < 0.11.0-r0 | All versions (No fix recorded)
- openstack-horizon-2025.2< 25.5.2_git20260617-r4
Wolfi5 products
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.10.2-r1 | < 0.11.0-r0 | All versions (No fix recorded)
- superset-6.0< 6.0.0-r13
- superset-6.1< 6.1.0-r6
- superset-6.1-iamguarded-compatAll versions (No fix recorded)
Ubuntu2 products
- pillowAll versions (No fix recorded)
- pillow-python2All versions (No fix recorded)
Debian1 product
- pillowAll versions (No fix recorded) | < 12.3.0-1
PyPI1 product
- pillow< 12.3.0
Python1 product
- pillow< 12.3.0
Python-pillow1 product
- pillow< 12.3.0
7 vendors · 26 products
References
11 links- github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6X Refsource CONFIRMWEBEVIDENCEREPORTAdvisoryExploitVendor Advisory
- github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721X Refsource MISCWEBFIXPatch
