CVE-2026-59203

Katalog CVE

CVSS 7.5 · High EPSS 0,40%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada python pillow. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 exploit · advisory vendor
• https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83 patch
• https://github.com/python-pillow/Pillow/pull/9708 issue tracking · patch
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 release notes