CVE-2026-59200 Details
Description
Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.
A denial-of-service vulnerability has been identified in the Python imaging library Pillow, specifically in versions 5.1.0 prior to 12.3.0. The issue arises in the PdfParser module, where the PdfStream.decode() method calls zlib.decompress() with the PDF stream's Length field as the buffer size. This approach lacks a limit on the decompressed data size, allowing a maliciously crafted FlateDecode PDF stream to cause significant memory exhaustion. The vulnerability can lead to out-of-memory conditions on the server, causing termination or severe application degradation, particularly when processing untrusted PDF files.
Users can upgrade to Pillow version 12.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09 | [email protected] | Patch |
| https://github.com/python-pillow/Pillow/pull/9718 | [email protected] | Issue TrackingPatch |
| https://github.com/python-pillow/Pillow/releases/tag/12.3.0 | [email protected] | Release Notes |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python pillow | >= 5.1.0, < 12.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |