CVE-2026-59205 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow'… | CVSS 7.5 HIGH

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Metadata

CVE ID: CVE-2026-59205
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-02 21:05 UTC
Published: 2026-07-14 15:48 UTC
Last updated: 2026-07-14 17:31 UTC
Primary CWE: CWE-787
CWE-787: Out-of-bounds Write
Vendor / Product: python-pillow / Pillow
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
python-pillow	Pillow	—	< 12.3.0

Weakness (CWE)

CWE	Source	Description
CWE-787	cna	CWE-787: Out-of-bounds Write

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (4)

https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
https://github.com/python-pillow/Pillow/pull/9715 https://github.com/python-pillow/Pillow/pull/9715
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
https://github.com/python-pillow/Pillow/releases/tag/12.3.0 https://github.com/python-pillow/Pillow/releases/tag/12.3.0