{"vulnerability": "CVE-2026-59199", "sightings": [{"uuid": "c9062d4b-8991-4ac5-a8b1-3ccbe427115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59199", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "content": "", "creation_timestamp": "2026-07-21T00:35:17.054203Z"}, {"uuid": "63016cc9-eb72-4511-9214-60741dcc43b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59199", "type": "seen", "source": "https://gist.github.com/alon710/8369d28698d5eaa2f4badffaca60e4b4", "content": "# CVE-2026-59199: CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59199\n\n## Summary\nA critical signed 32-bit integer overflow vulnerability was identified in Pillow (Python Imaging Library) versions prior to 12.3.0. The vulnerability resides within the native C extension library (libImaging) during coordinate and bounding box calculations in functions like ImagingPaste and ImagingFill2. Exploitation can bypass bounds and clipping safety checks, leading to a controlled heap backward underwrite and application crash.\n\n## TL;DR\nA signed integer overflow in Pillow before 12.3.0 allows unauthenticated remote attackers to bypass memory safety checks and perform a native heap out-of-bounds write via crafted coordinates, leading to a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0039 (Percentile: 31.40%)\n- **Impact**: Denial of Service, Native Heap Corruption\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow prior to version 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or higher\n- Apply strict application-layer validation on bounding box input values\n- Sandbox Python imaging processes inside containerized environments with seccomp policies enabled\n\n**Remediation Steps:**\n1. Identify all environment dependencies referencing Pillow packages prior to version 12.3.0\n2. Update requirements files to specify Pillow>=12.3.0 and redeploy the application\n3. Implement bounding box sanitization functions for any user-facing APIs exposing image coordinate parameters\n\n## References\n\n- [NVD CVE-2026-59199 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-59199)\n- [Pillow Security Advisory GHSA-6r8x-57c9-28j4](https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4)\n- [Fix Pull Request #9703](https://github.com/python-pillow/Pillow/pull/9703)\n- [Fix Commit ceefc348](https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)\n- [Pillow Release 12.3.0 Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59199) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T10:31:21.339083Z"}]}