What’s Vulnerable › Vulnerabilities

CVE-2026-59205: Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-787

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Affected products

• python-pillow Pillow: before 12.3.0 — fixed in 12.3.0
• Pypi Pillow: before 12.3.0; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+100) — fixed in 12.3.0

How to fix

Upgrade to a fixed version: python-pillow Pillow 12.3.0; Pypi Pillow 12.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
• https://github.com/python-pillow/Pillow/pull/9715
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Get alerted when CVE-2026-59205 or the next vulnerability affects your stack