CVE-2026-59204: CVE-2026-59204: Denial of Service via Memory Exhaustion in Pillow JPEG2000 Decoder

#security #cve #cybersecurity

CVE-2026-59204: Denial of Service via Memory Exhaustion in Pillow JPEG2000 Decoder

Vulnerability ID: CVE-2026-59204
CVSS Score: 7.5
Published: 2026-07-20

A Denial of Service vulnerability exists in the JPEG2000 decoder of Pillow (versions 8.2.0 to 12.2.0) due to memory allocation state accumulation across tiles, leading to rapid process termination.

TL;DR

A state accumulation bug in Pillow's JPEG2000 tile decoder allows unauthenticated attackers to crash applications via Out-of-Memory termination using crafted multi-tiled images.

Technical Details

CWE ID: CWE-789 / CWE-770
Attack Vector: Network (Unauthenticated)
CVSS Score: 7.5 (v3.1) / 8.7 (v4.0)
EPSS Score: 0.00398 (32.21% Percentile)
Impact: Denial of Service (OOM Crash)
Exploit Status: None / No Public Exploits
KEV Status: Not Listed

Affected Systems

python-pillow/Pillow
Pillow: >= 8.2.0, < 12.3.0 (Fixed in: 12.3.0)

Code Analysis

Commit: 13ada41

Calculate JPEG2000 total_component_width for each tile in isolation

Mitigation Strategies

Upgrade Pillow to version 12.3.0 or later.
Enforce format restrictions on Image.open() to disable JPEG2000 decoding.
Deploy isolated application processes with memory limit restrictions.

Remediation Steps:

Run 'pip install --upgrade Pillow>=12.3.0' in your Python environment.
Update your codebase to pass a safe list of formats to the PIL open method: Image.open(stream, formats=['PNG', 'JPEG', 'GIF', 'WEBP']).
Enforce container-level memory constraints using standard orchestration platforms.
Deploy YARA signatures to detect JPEG2000 byte markers at the perimeter.

References

Read the full report for CVE-2026-59204 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community