CVE-2026-59205

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

PUBLISHED Reserved 2026-07-02 | Published 2026-07-14 | Updated 2026-07-14 | Assigner GitHub_M

Problem types

CWE-787: Out-of-bounds Write

Product status

References

github.com/...Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 exploit

github.com/...Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

github.com/python-pillow/Pillow/pull/9715

github.com/...ommit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721

github.com/python-pillow/Pillow/releases/tag/12.3.0

cve.org (CVE-2026-59205)

nvd.nist.gov (CVE-2026-59205)

Download JSON