PT-2026-58091 · Python Pillow+1 · Pillow

Publicado 2026-07-14 · Atualizado 2026-07-14 · CVE-2026-59203

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2026-59203

Produtos afetados

Pillow

Referências · 5

• https://github.com/python-pillow/Pillow/pull/9708 · Correção
• https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83 · Correção
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 · Aviso do Fabricante
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59203 · Nota de Segurança