CVE-2026-59199

Pillow is a widely used Python imaging library that exposes native C APIs for operations such as Image.paste(), Image.crop(), and Image.alpha_composite(). The CVE details a signed 32‑bit integer coordinate overflow that can trigger a native heap out‑of‑bounds write when these functions are called with coordinates near the signed 32‑bit limit. While the CVE text does not describe any subsequent exploitation, it is inferred that such a memory corruption could be leveraged for arbitrary code execution or other malicious actions if the application were to run with elevated privileges, or could lead to a denial‑of‑service. The vulnerability is classified under CWE‑190 (Integer Overflow or Wraparound) and CWE‑787 (Out‑of‑Bounds Write).

All releases of the Pillow library made by the Python Pillow project that are older than version 12.3.0 are vulnerable. The issue can be triggered in any Python application that uses Image.paste(), Image.crop() or Image.alpha_composite() with coordinate values that approach the signed 32-bit integer limit. Pillow is commonly incorporated into web servers, content management systems, photo editors, and other image-handling tools, so the impact could span a large set of deployed software. The fix is incorporated in Pillow 12.3.0, which disables the vulnerable code path and validates coordinates against the 32‑bit boundary.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The CVE information indicates that the overflow is triggered by the library’s native code, so the attack vector is inferred to require control over the image data passed to the vulnerable functions. If an attacker can supply images containing near‑limit coordinates, the overflow could be triggered. Because the CVSS metric does not specify remote or local vectors, the exact ease of exploitation remains uncertain; nevertheless, the potential for heap corruption and the high severity score warrant prompt attention.