Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.
References
| Link | Resource |
|---|---|
| https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b | Patch |
| https://github.com/python-pillow/Pillow/pull/9703 | Exploit Issue Tracking Patch |
| https://github.com/python-pillow/Pillow/releases/tag/12.3.0 | Release Notes |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 | Exploit Vendor Advisory |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 | Exploit Vendor Advisory |
Configurations
History
15 Jul 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 - Exploit, Vendor Advisory |
14 Jul 2026, 20:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | |
| First Time |
Python
Python pillow |
|
| References | () https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b - Patch | |
| References | () https://github.com/python-pillow/Pillow/pull/9703 - Exploit, Issue Tracking, Patch | |
| References | () https://github.com/python-pillow/Pillow/releases/tag/12.3.0 - Release Notes | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 - Exploit, Vendor Advisory |
14 Jul 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-14 16:17
Updated : 2026-07-15 16:16
NVD link : CVE-2026-59199
Mitre link : CVE-2026-59199
CVE.ORG link : CVE-2026-59199
JSON object : View
Products Affected
python
- pillow