DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59205: CVE-2026-59205: Heap-Based Buffer Overflow in Pillow ImageCms Module

#security #cve #cybersecurity

CVE-2026-59205: Heap-Based Buffer Overflow in Pillow ImageCms Module

Vulnerability ID: CVE-2026-59205
CVSS Score: 7.5
Published: 2026-07-20

CVE-2026-59205 is a high-severity heap-based out-of-bounds write vulnerability affecting Pillow prior to version 12.3.0. The flaw stems from a validation omission in the ImageCmsTransform class where source and destination image modes are not checked against the configurations defined during the creation of the transform. An attacker can exploit this discrepancy to trigger a heap buffer overflow or an out-of-bounds read by supplying an under-allocated target image buffer.

TL;DR

A heap-based buffer overflow exists in Pillow prior to 12.3.0's ImageCms module. Lacking verification of image modes allows writing multi-byte output data into under-allocated buffers, potentially enabling remote code execution.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-787
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 7.5 (High)
  • Impact: Availability (High)
  • Exploit Status: Proof of Concept available in tests
  • KEV Status: Not listed

Affected Systems

  • Pillow (Python Imaging Library)
  • Pillow: < 12.3.0 (Fixed in: 12.3.0)

Code Analysis

Commit: a9ffc42

Fix ImageCms mode mismatch checks

Exploit Details

Mitigation Strategies

  • Upgrade Pillow to version 12.3.0 or later to ensure Python-level mode checks are actively enforced.
  • Implement strong input validation to verify that uploaded image data conforms to strict physical and structural parameters before executing color translations.
  • Sanitize and restrict the use of custom image subclasses in transformation pipelines to block mock objects from bypassing mode property assertions.

Remediation Steps:

  1. Run your package manager upgrade command: pip install --upgrade Pillow>=12.3.0
  2. Identify all code locations invoking ImageCms.buildTransform or executing ImageCmsTransform.apply.
  3. Ensure any custom-allocated destination buffers (imOut) have their modes programmatically validated against the expected target output prior to calling transform methods.

References

Read the full report for CVE-2026-59205 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)