CVE-2026-59204— Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| python-pillow | Pillow | >= 8.2.0, < 12.3.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Source: NVD (National Vulnerability Database)
Vulnerability Description
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未经控制的内存分配
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| python-pillow | Pillow | >= 8.2.0, < 12.3.0 | - |
II. Public POCs for CVE-2026-59204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59204
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59204 (2)
Vendor Advisories for CVE-2026-59204 (1)
Vendor Pages for CVE-2026-59204 (1)
- 🔗 Release 12.3.0 · python-pillow/Pillow · GitHubx_refsource_MISC
Same Patch Batch · python-pillow · 2026-07-14 · 8 CVEs total
| CVE-2026-59197 | 8.2 HIGH | Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow i |
| CVE-2026-59199 | 7.5 HIGH | Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate ov |
| CVE-2026-59205 | 7.5 HIGH | Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode |
| CVE-2026-59200 | 7.5 HIGH | Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() |
| CVE-2026-59198 | 6.5 MEDIUM | Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated ima |
| CVE-2026-59203 | 5.3 MEDIUM | Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of ser |
| CVE-2026-54058 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIda |
IV. Related Vulnerabilities
Same product: Pillow
- CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row strid - CVE-2026-59197
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.Rank - CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decod - CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacen - CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in `ImageCmsTran
Same vendor: python-pillow
- CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row strid - CVE-2026-59197
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.Rank - CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decod - CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacen - CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in `ImageCmsTran
Same weakness: CWE-789
- CVE-2026-40378
Windows Local Security Authority Subsystem Service (LSASS) D - CVE-2026-55213
h2o: musl libc stack overflow (QPACK) - CVE-2026-40006
Apache IoTDB: Unauthenticated heap-exhaustion DoS via unboun - CVE-2026-59938
pypdf: Possible large memory usage for wrong image dimension - CVE-2026-15053
Tanium addressed a denial of service vulnerability in Tanium
V. Comments for CVE-2026-59204
No comments yet