PT-2026-58090 · Pypi · Pillow

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-59199

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description Public image coordinate APIs in the Pillow Python imaging library can trigger a native heap out-of-bounds write. This occurs when coordinates near the signed 32-bit integer limits are provided to the Image.paste(), Image.crop(), or Image.alpha composite() functions.

Recommendations Update to version 12.3.0. As a temporary mitigation, avoid providing coordinates near the signed 32-bit integer limits to the Image.paste(), Image.crop(), and Image.alpha composite() functions.

Exploit

Fix

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2026-59199

GHSA-6R8X-57C9-28J4

Affected Products

Pillow

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59199.json · Exploit
• https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b · Patch
• https://github.com/python-pillow/Pillow/pull/9703 · Patch
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59199 · Security Note
• https://osv.dev/vulnerability/CVE-2026-59199 · Vendor Advisory
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 · Note