CVE-2026-59197

Katalog CVE

CVSS 8.2 · High EPSS 0,45%

Kerentanan Integer Overflow or Wraparound pada python pillow. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr exploit · advisory vendor
• https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 patch
• https://github.com/python-pillow/Pillow/pull/9695 issue tracking · patch
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 release notes