high 7.5

CVE-2026-59199 json

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

published 2026-07-14 3 mo ago modified 2026-10-24 15 d ago also BIT-pillow-2026-59199 , EUVD-2026-43739 , GHSA-6r8x-57c9-28j4 , PYSEC-2026-3451

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

Patch / fix

fixed in 3 distros 4 links 3

pypi pillow 12.3.0
bitnami pillow 12.3.0
python pillow 12.3.0

debian ubuntu suse opensuse

pillow Debian 14 12.3.0-1

debian advisories DEBIAN-CVE-2026-59199

pillow Ubuntu 22.04 LTS 9.0.1-1ubuntu0.6
pillow Ubuntu 24.04 LTS 10.2.0-1ubuntu1.4
pillow Ubuntu 26.04 LTS 12.1.1-2ubuntu1.4

ubuntu advisories UBUNTU-CVE-2026-59199

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-Pillow SLES 16.0, SLES for SAP applications 16.0 11.3.0-160000.8.1
python-Pillow SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.5.0-150400.5.25.1
python-Pillow SLE Module for Package Hub 15 SP7 7.2.0-150300.3.30.1

suse advisories SUSE-SU-2026:23217-1 SUSE-SU-2026:23228-1 SUSE-SU-2026:3268-1 SUSE-SU-2026:3084-1

python-Pillow openSUSE Leap 16.0 11.3.0-160000.8.1

opensuse advisories openSUSE-SU-2026:21544-1

github.com/python-pillow/Pillow@ceefc34 commit
github.com/python-pillow/Pillow#9703 pull request
github.com/python-pillow/Pillow/releases/tag/12.3.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59199 updated 2026-11-04 cvss 7.5

Pillow: Pillow: Denial of Service via out-of-bounds write in image processing

Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9
affected: workaround, no fix available
Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, +3 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-caikit-tgis-serving-rhel9, rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
affected: workaround, no fix available
Red Hat AI Inference Server 3.3 rhaiis/model-opt-cuda-rhel9 1787601159
fixed: vendor fix RHSA-2026:59518
Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1789681128, rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1789681126, rhaii/vllm-cuda-rhel9 1790090131, rhaii/vllm-rocm-rhel9 1789681126, rhaii/vllm-rocm-rhel9 1790109620, +4 more
fixed: vendor fix RHSA-2026:70996
Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1788260684, rhelai3/bootc-aws-cuda-rhel9 1788273908, rhelai3/bootc-gcp-cuda-rhel9 1788273977, rhelai3/disk-image-cuda-rhel9 1788290314, rhelai3/bootc-azure-cuda-rhel9 1788273909
fixed: vendor fix RHSA-2026:62336
Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1790868254, rhelai3/bootc-rocm-rhel9 1790614447, rhelai3/bootc-aws-cuda-rhel9 1790881122, rhelai3/bootc-gcp-cuda-rhel9 1790881123, rhelai3/disk-image-cuda-rhel9 1790957417, rhelai3/bootc-azure-cuda-rhel9 1790881120, +1 more
fixed: vendor fix RHSA-2026:76150

show 13 more

Red Hat OpenShift AI 3.3 rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-llm-d-inference-scheduler-rhel9 1789662430
fixed: vendor fix RHSA-2026:73987
Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-llm-d-kv-cache-rhel9 1787169432, rhoai/odh-openvino-model-server-rhel9 1787303251, rhoai/odh-th06-cpu-torch210-py312-rhel9 1787076778, +18 more
fixed: vendor fix RHSA-2026:60520
Red Hat Quay 3.9 quay/quay-rhel8 1785950004
fixed: vendor fix RHSA-2026:50931
Red Hat Quay 3.10 quay/quay-rhel8 1786395065
fixed: vendor fix RHSA-2026:53520
Red Hat Quay 3.12 quay/quay-rhel8 1786170635
fixed: vendor fix RHSA-2026:52968
Red Hat Quay 3.14 quay/quay-rhel8 1788593843
fixed: vendor fix RHSA-2026:70267
Red Hat Quay 3.15 quay/quay-rhel8 1785261506
fixed: vendor fix RHSA-2026:48933
Red Hat Quay 3.16 quay/quay-rhel9 1789563753
fixed: vendor fix RHSA-2026:69255
Red Hat Quay 3.17 quay/quay-rhel9 1786181981
fixed: vendor fix RHSA-2026:54395
Red Hat Quay 3.18 quay/quay-rhel9 1791265590
fixed: vendor fix RHSA-2026:81110
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 python-pillow 10.3.0-1.el9ap, ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-25/lightspeed-chatbot-rhel8, ansible-automation-platform-26/lightspeed-chatbot-rhel9, +1 more Red Hat Enterprise Linux 7 python-pillow, python-pillow-qt, python-pillow-tk, python-pillow-sane, python-pillow 10.3.0-1.el9ap Red Hat Enterprise Linux 8 python3-pillow, python3-pillow-tk, python-pillow 10.3.0-1.el9ap Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-rocm-rhel9 1788260620, rhelai3/bootc-azure-rocm-rhel9 1788273908
not affected: vulnerable code not present
Red Hat OpenShift AI (RHOAI) rhoai/odh-caikit-nlp-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-kserve-autogluon-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more
not affected: component not present
Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, rhoai/odh-rhel9-operator 1790686009, +75 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-trainer-rhel9 1787089049, rhoai/odh-eval-hub-rhel9 1787087463, rhoai/odh-maas-api-rhel9 1787153683, rhoai/odh-mlserver-rhel9 1786611800, +76 more Red Hat Quay 3.9 quay/clair-rhel8 1785563558, quay/quay-builder-rhel8 1785563573, quay/quay-operator-rhel8 1785563557, quay/quay-operator-bundle 1785954125, quay/quay-bridge-operator-rhel8 1785563571, quay/quay-bridge-operator-bundle 1785564443, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1786394800, quay/quay-builder-rhel8 1786394811, quay/quay-operator-rhel8 1786394797, quay/quay-operator-bundle 1786398374, quay/quay-bridge-operator-rhel8 1786394781, quay/quay-bridge-operator-bundle 1786395288, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1786170209, quay/quay-builder-rhel8 1786170241, quay/quay-operator-rhel8 1786170245, quay/quay-operator-bundle 1786174731, quay/quay-bridge-operator-rhel8 1786170019, quay/quay-bridge-operator-bundle 1786171106, +3 more Red Hat Quay 3.14 quay/clair-rhel8 1788593782, quay/quay-builder-rhel8 1788593707, quay/quay-operator-rhel8 1788593658, quay/quay-operator-bundle 1788598271, quay/quay-bridge-operator-rhel8 1788594258, quay/quay-bridge-operator-bundle 1788595604, +3 more

+5 more productsfewer

Red Hat Quay 3.15 quay/clair-rhel8 1785177181, quay/quay-builder-rhel8 1785180550, quay/quay-operator-rhel8 1785177009, quay/quay-operator-bundle 1785322285, quay/quay-bridge-operator-rhel8 1785177338, quay/quay-bridge-operator-bundle 1785274696, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1789191202, quay/quay-builder-rhel9 1789492236, quay/quay-operator-rhel9 1789190909, quay/quay-operator-bundle 1789627085, quay/quay-bridge-operator-rhel9 1789191073, quay/quay-bridge-operator-bundle 1789191920, +3 more Red Hat Quay 3.17 quay/clair-rhel9 1786181669, quay/quay-builder-rhel9 1786181688, quay/quay-operator-rhel9 1786181701, quay/quay-operator-bundle 1786429805, quay/quay-bridge-operator-rhel9 1786181654, quay/quay-bridge-operator-bundle 1786182526, +3 more Red Hat Quay 3.18 quay/clair-rhel9 1791279250, quay/quay-builder-rhel9 1791305715, quay/quay-rhel9-operator 1791305677, quay/quay-operator-bundle 1791306533, quay/quay-bridge-rhel9-operator 1791279118, quay/quay-bridge-operator-bundle 1791298533, +3 more Red Hat Satellite 6 python-pillow 10.3.0-1.el9ap, python-pillow 12.2.0-1.el8pc

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 3 mo ago (2026-07-15)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/python-pillow/Pillow/pull/9703 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	pillow	<12.3.0	12.3.0
bitnami	pillow	<12.3.0	12.3.0

Affected products

python-pillow Pillow

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

References

github.com /python-pillow/Pillow/pull/9703
web, exploit, issue-tracking, patch
github.com /python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b
web, patch
github.com /python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4
exploit, web, vendor-advisory, advisory, evidence
github.com /python-pillow/Pillow/releases/tag/12.3.0
web, release-notes, article, advisory
nvd.nist.gov /vuln/detail/CVE-2026-59199
advisory, web
github.com /pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml
web
github.com /python-pillow/Pillow
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary