CVE-2026-59199: CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow

#security #cve #cybersecurity

CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow

Vulnerability ID: CVE-2026-59199
CVSS Score: 7.5
Published: 2026-07-20

A critical signed 32-bit integer overflow vulnerability was identified in Pillow (Python Imaging Library) versions prior to 12.3.0. The vulnerability resides within the native C extension library (libImaging) during coordinate and bounding box calculations in functions like ImagingPaste and ImagingFill2. Exploitation can bypass bounds and clipping safety checks, leading to a controlled heap backward underwrite and application crash.

TL;DR

A signed integer overflow in Pillow before 12.3.0 allows unauthenticated remote attackers to bypass memory safety checks and perform a native heap out-of-bounds write via crafted coordinates, leading to a denial of service.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-190, CWE-787
Attack Vector: Network (Remote)
CVSS Score: 7.5 (High)
EPSS Score: 0.0039 (Percentile: 31.40%)
Impact: Denial of Service, Native Heap Corruption
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

Pillow prior to version 12.3.0
Pillow: < 12.3.0 (Fixed in: 12.3.0)

Code Analysis

Commit: ceefc34

Promote size tracking variables to 64-bit integers and cast to int64_t before subtraction to prevent integer overflow.

@@ -274,7 +274,7 @@ int
 ImagingPaste(
     Imaging imOut, Imaging imIn, Imaging imMask, int dx0, int dy0, int dx1, int dy1
 ) {
-    int xsize, ysize;
+    int64_t xsize, ysize;
     int pixelsize;
     int sx0, sy0;
     ImagingSectionCookie cookie;
@@ -286,8 +286,8 @@ ImagingPaste(

     pixelsize = imOut->pixelsize;

-    xsize = dx1 - dx0;
-    ysize = dy1 - dy0;
+    xsize = (int64_t)dx1 - dx0;
+    ysize = (int64_t)dy1 - dy0;

Mitigation Strategies

Upgrade Pillow to version 12.3.0 or higher
Apply strict application-layer validation on bounding box input values
Sandbox Python imaging processes inside containerized environments with seccomp policies enabled

Remediation Steps:

Identify all environment dependencies referencing Pillow packages prior to version 12.3.0
Update requirements files to specify Pillow>=12.3.0 and redeploy the application
Implement bounding box sanitization functions for any user-facing APIs exposing image coordinate parameters

References

Read the full report for CVE-2026-59199 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community