CVE-2026-59205

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

State: Published
Severity: 7.5 High
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: Jul 2, 2026

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
Pillowpython-pillow	< 12.3.0Affected

References

https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
https://github.com/python-pillow/Pillow/pull/9715
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
https://github.com/python-pillow/Pillow/releases/tag/12.3.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.