CVE-2026-59204

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Description

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.

Scores

Faiblesses (CWE)

• CWE-789
• CWE-770

Avis

• GHSA-vjc4-5qp5-m44j — Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
• PYSEC-2026-3496 — Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Références européennes

• ENISA EUVD · EUVD-2026-43730
• GCVE · GCVE-0-2026-59204

Avis du CERT-FR

• CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
• CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* ≥ 8.2.0 < 12.3.0

Produits affectés

Références

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j
• https://github.com/python-pillow/Pillow/pull/9704
• https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0

Sources