https://vulnerability.circl.lu/sightings/feed 2026-07-22T06:28:44.894886+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d8b4b80a-e3cc-4f53-b3a9-b0a965b43e72/export 2026-07-22T06:28:44.921802+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d8b4b80a-e3cc-4f53-b3a9-b0a965b43e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://gist.github.com/alon710/a3a7380a4e0465c6c32d9063bd8033a6", "content": "# CVE-2026-59197: CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59197\n\n## Summary\nA heap out-of-bounds write vulnerability exists in Pillow prior to version 12.3.0 due to an integer overflow during image expansion calculations. The subsequent patch introduced a division-by-zero regression causing denial of service.\n\n## TL;DR\nInteger overflow in Pillow image expansion leads to heap out-of-bounds write. Initial patch introduces a division-by-zero crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.2\n- **Impact**: Heap Out-of-Bounds Write / Denial of Service\n- **Exploit Status**: PoC Available\n\n## Affected Systems\n\n- Pillow (Python Imaging Library) versions prior to 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade to Pillow 12.3.0 or higher\n- Implement strict input validation on filter sizes at the application boundary\n- Validate margin is non-zero before calling C extension functions\n\n**Remediation Steps:**\n1. Verify the current Pillow version using python -c 'import PIL; print(PIL.__version__)'\n2. Upgrade using pip install --upgrade Pillow>=12.3.0\n3. Deploy updated application code to production\n\n## References\n\n- [GitHub Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr)\n- [Fix Commit](https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1)\n- [Pull Request](https://github.com/python-pillow/Pillow/pull/9695)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59197) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T12:31:41.596835Z"} 2026-07-21T12:31:41.596835+00:00 https://vulnerability.circl.lu/sighting/4d7d9870-4e6d-428d-bd3e-c6cb96013472/export 2026-07-22T06:28:44.924830+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "4d7d9870-4e6d-428d-bd3e-c6cb96013472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59197", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "content": "", "creation_timestamp": "2026-07-21T00:35:21.497750Z"} 2026-07-21T00:35:21.497750+00:00