CVE-2026-59200: Remote Denial of Service via PDF Decompression Bomb in Pillow
Vulnerability ID: CVE-2026-59200
CVSS Score: 7.5
Published: 2026-07-20
CVE-2026-59200 is a high-severity uncontrolled resource consumption vulnerability in the Pillow Python Imaging Library. The flaw resides in the PDF stream decoder, allowing remote, unauthenticated attackers to trigger host out-of-memory crashes by submitting malicious PDF decompression bombs.
TL;DR
Unbounded zlib decompression in Pillow's PDF parser allows remote attackers to cause system Out-of-Memory crashes using crafted PDF files.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network
- CVSS: 7.5
- EPSS Score: 0.0035
- Impact: High (Denial of Service)
- Exploit Status: Proof-of-Concept Available
- KEV Status: Not Listed
Affected Systems
- Pillow (python-pillow)
Mitigation Strategies
- Upgrade Pillow to version 12.3.0 or higher to resolve the unbounded decompression logic.
- Enforce explicit format constraints using Image.open(formats=[...]) to block the PDF parser from initiating auto-detection.
- Configure operating system and container limits to bound application memory consumption.
Remediation Steps:
- Check active Pillow versions in your environment using
pip show Pillow. - Update dependencies and requirements configuration to lock Pillow to
>=12.3.0. - Deploy container resource limits in Kubernetes or systemd configuration files to mitigate memory exhaustion blast-radius.
References
- Official Fix Commit
- Pillow Pull Request #9718
- GitHub Security Advisory GHSA-jjj6-mw9f-p565
- NVD Vulnerability Details
- Pillow Release Tag (12.3.0)
- Wiz Vulnerability Analysis Database
Read the full report for CVE-2026-59200 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)