CVE-2026-59205highCWE-787

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.4%

probabilidad de explotación

0.4%top 69% de las CVE

explotación observada

noninguna fuente lo reporta

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

python-pillow · Pillow

Referencias

https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 https://github.com/python-pillow/Pillow/pull/9715 https://github.com/python-pillow/Pillow/releases/tag/12.3.0 https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6