CVE-2026-59197
published 2026-07-14CVE-2026-59197: Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd…
PriorityP344high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.45%
37.1th percentile
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | >= 0 < 12.3.0 | 12.3.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Pillow up to 12.2.x RankFilter ImageFilter.RankFilter.filter size out-of-bounds write (Nessus ID 327748 / WID-SEC-2026-2592)
vuldb·2026-08-13·CVSS 8.2
CVE-2026-59197 [HIGH] Pillow up to 12.2.x RankFilter ImageFilter.RankFilter.filter size out-of-bounds write (Nessus ID 327748 / WID-SEC-2026-2592)
A vulnerability, which was classified as critical, was found in Pillow up to 12.2.x. This affects the function ImageFilter.RankFilter.filter of the component RankFilter. Such manipulation of the argument size leads to out-of-bounds write.
This vulnerability is referenced as CVE-2026-59197. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
GHSA
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
ghsa·2026-07-20
CVE-2026-59197 [HIGH] CWE-190 Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
### Summary
Pillow's public rank-filter API can trigger a native heap out-of-bounds write
when given a very large odd filter size.
Minimal public API trigger:
```python
from PIL import Image, ImageFilter
im = Image.new("L", (3, 3), 128)
im.filter(ImageFilter.MedianFilter(4294967295))
```
`ImageFilter.RankFilter.filter()` calls `image.expand(size // 2, size // 2)`
before rank-filter size validation. With `size = 4294967295`, the
expansion margin is `2147483647` (`INT_MAX`). `ImagingExpand()` then computes
the output dimensions with unchecked signed `int` arithmetic. On tested builds,
this wraps to a tiny output image and the border-expansion loop writes past the
allocation.
This is re
Red Hat
Pillow: Pillow: Native heap out-of-bounds write
vendor_redhat·2026-07-14·CVSS 8.2
CVE-2026-59197 [HIGH] CWE-787 Pillow: Pillow: Native heap out-of-bounds write
Pillow: Pillow: Native heap out-of-bounds write
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed inte
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [epel-all]
bugzilla·2026-07-16·CVSS 8.2
CVE-2026-59197 [HIGH] CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [epel-all]
CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [fedora-all]
bugzilla·2026-07-16·CVSS 8.2
CVE-2026-59197 [HIGH] CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [fedora-all]
CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds write
bugzilla·2026-07-14·CVSS 8.2
CVE-2026-59197 [HIGH] CVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds write
CVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds write
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1https://github.com/python-pillow/Pillow/pull/9695https://github.com/python-pillow/Pillow/releases/tag/12.3.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmrhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr
2026-07-14
Published