Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M
CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
High 7.5
In plain English
A high-severity out-of-bounds write in Pillow from python-pillow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pillow | no fix listed | DEBIAN-CVE-2026-59205 |
| Debian:13 | pillow | no fix listed | DEBIAN-CVE-2026-59205 |
| Debian:14 | pillow | 12.3.0-1 | DEBIAN-CVE-2026-59205 |
| PyPI | pillow | 12.3.0 | PYSEC-2026-3453 |
| PyPI | pillow | 12.3.0 | GHSA-9hw9-ch79-4vh6 |
| Ubuntu:22.04:LTS | pillow | 9.0.1-1ubuntu0.6 | UBUNTU-CVE-2026-59205 |
| Ubuntu:22.04:LTS | pillow | 9.0.1-1ubuntu0.6 | USN-8999-1 |
| Ubuntu:24.04:LTS | pillow | 10.2.0-1ubuntu1.4 | USN-8999-1 |
| Ubuntu:24.04:LTS | pillow | 10.2.0-1ubuntu1.4 | UBUNTU-CVE-2026-59205 |
| Ubuntu:26.04:LTS | pillow | 12.1.1-2ubuntu1.4 | USN-8999-1 |
| Ubuntu:26.04:LTS | pillow | 12.1.1-2ubuntu1.4 | UBUNTU-CVE-2026-59205 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | < 12.3.0 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/pull/9715 x_refsource_MISC
- https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0 x_refsource_MISC