PYSEC-2026-3453

En bref

Publiée: 2026-07-14 16:17 UTC
Mise à jour: 2026-07-15 20:11 UTC
CVE: CVE-2026-59205
Alias: BIT-pillow-2026-59205, GHSA-9hw9-ch79-4vh6
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Paquets affectés

Paquet	Versions
PyPI · pillow	introduced 0, fixed 12.3.0

Références

https://github.com/python-pillow/Pillow/releases/tag/12.3.0 ADVISORY
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 FIX
https://github.com/python-pillow/Pillow/pull/9715 FIX
https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 EVIDENCE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database