PT-2026-58105 · Pypi · Pillow

Published 2026-07-14 · Updated 2026-07-15 · CVE-2026-59197

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description The public rank-filter API in the Pillow Python imaging library allows a native heap out-of-bounds write when a very large odd filter size is provided. This occurs because the ImageFilter.RankFilter.filter() function calls image.expand(size // 2, size // 2) before validating the rank-filter size, and the ImagingExpand() function calculates output dimensions using unchecked signed int arithmetic, which is a type of calculation that does not account for values exceeding the maximum limit of a signed integer.

Recommendations Update to version 12.3.0.

Exploit

Fix

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2026-59197

GHSA-XJ96-63GP-2GMR

Affected Products

Pillow

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59197.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-59197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59197 · Security Note
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr · Note
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 · Note
• https://github.com/python-pillow/Pillow/pull/9695 · Note
• https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 · Note
• https://twitter.com/UpwindMDR/status/2077280709702463587 · Twitter Post