CVE-2026-59200

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Uncontrolled Resource Consumption pada python pillow. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 exploit · advisory vendor
• https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09 patch
• https://github.com/python-pillow/Pillow/pull/9718 issue tracking · patch
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 release notes