CVE-2026-59204

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Memory Allocation with Excessive Size Value pada python pillow. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j exploit · advisory vendor
• https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca patch
• https://github.com/python-pillow/Pillow/pull/9704 exploit · issue tracking · patch
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 release notes