CVE-2026-59204highCWE-789

CVE-2026-59204: falha de alta gravidade em python-pillow Pillow

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Pillow+ Monitorar pillow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
python-pillow · Pillow
CVEs relacionadas — python-pillow Pillow

No mesmo produto, das mais perigosas para as menos.

CVE-2026-112900CRITICALPillow: Argument Injection in Ghostscript call, potentially leading into RCEEPSS 1.3%CVE-2026-112393CRITICALPillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOEPSS 1.0%CVE-2026-112403CRITICALPillow: Heap buffer overflow in ImagingJpegDecodeEPSS 0.9%CVE-2026-112398CRITICALPillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionEPSS 0.7%CVE-2026-112396MEDIUMPillow: Heap use-after-free when encoding TIFF to an in-memory bufferEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%