CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging
Vulnerability ID: CVE-2026-59197
CVSS Score: 8.2
Published: 2026-07-20
A heap out-of-bounds write vulnerability exists in Pillow prior to version 12.3.0 due to an integer overflow during image expansion calculations. The subsequent patch introduced a division-by-zero regression causing denial of service.
TL;DR
Integer overflow in Pillow image expansion leads to heap out-of-bounds write. Initial patch introduces a division-by-zero crash.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-190, CWE-787
- Attack Vector: Network
- CVSS v3.1 Score: 8.2
- Impact: Heap Out-of-Bounds Write / Denial of Service
- Exploit Status: PoC Available
Affected Systems
- Pillow (Python Imaging Library) versions prior to 12.3.0
-
Pillow: < 12.3.0 (Fixed in:
12.3.0)
Mitigation Strategies
- Upgrade to Pillow 12.3.0 or higher
- Implement strict input validation on filter sizes at the application boundary
- Validate margin is non-zero before calling C extension functions
Remediation Steps:
- Verify the current Pillow version using python -c 'import PIL; print(PIL.version)'
- Upgrade using pip install --upgrade Pillow>=12.3.0
- Deploy updated application code to production
References
Read the full report for CVE-2026-59197 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)