CVE-2026-59205

Published: Jul 14, 2026Modified: Jul 14, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Affected (1)

Products: Python: Pillow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Pillow	Before 12.3.0

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (5)

https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721

Source: security-advisories@github.com

Patch

https://github.com/python-pillow/Pillow/pull/9715

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/python-pillow/Pillow/releases/tag/12.3.0

Source: security-advisories@github.com

Release Notes

https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.