CVE-2026-59199
Fixed in a distro release EPSS <1%CVSS 7.5
Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | python-pillow | 2.0.0-23.gitd1c6db8.amzn2.0.20 |
| Amazon Linux 2 | python-pillow-devel | 2.0.0-23.gitd1c6db8.amzn2.0.20 |
| Amazon Linux 2 | python-pillow-doc | 2.0.0-23.gitd1c6db8.amzn2.0.20 |
| Amazon Linux 2 | python-pillow-sane | 2.0.0-23.gitd1c6db8.amzn2.0.20 |
| Amazon Linux 2 | python-pillow-tk | 2.0.0-23.gitd1c6db8.amzn2.0.20 |
| Amazon Linux 2023 | python3-pillow | 9.4.0-2.amzn2023.0.10 |
| Amazon Linux 2023 | python3-pillow-devel | 9.4.0-2.amzn2023.0.10 |
| Amazon Linux 2023 | python3-pillow-tk | 9.4.0-2.amzn2023.0.10 |
| Chainguard | label-studio | 1.23.0-r11 |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow | 3.14.0-r2 |
| Chainguard | open-webui | 0.10.2-r1 |
| Chainguard | open-webui | no fix |
| Chainguard | open-webui | 0.11.0-r0 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r4 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r5 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260630-r2 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260630-r2 |
| Chainguard | superset-6.0 | 6.0.0-r13 |
| Chainguard | superset-6.1 | 6.1.0-r6 |
| Chainguard | superset-fips-6.1 | 6.1.0-r5 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r7 |
| Chainguard | text-generation-inference | 3.3.7-r20 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r11 |
| Debian 12 | pillow | no fix |
| Debian 13 | pillow | no fix |
| Debian 14 | pillow | 12.3.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Pillow | 7.2.0-150300.3.30.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 16.0 | python-Pillow | 11.3.0-160000.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Pillow | 11.3.0-160000.8.1 |
| Ubuntu 22.04 LTS | pillow | no fix |
| Ubuntu 24.04 LTS | pillow | no fix |
| Ubuntu 26.04 LTS | pillow | no fix |
| Ubuntu Pro 14.04 LTS | pillow | no fix |
| Ubuntu Pro 16.04 LTS | pillow | no fix |
| Ubuntu Pro 18.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow | no fix |
| Ubuntu Pro 20.04 LTS | pillow-python2 | no fix |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | mlflow | 3.14.0-r2 |
| Wolfi | open-webui | 0.11.0-r0 |
| Wolfi | open-webui | 0.10.2-r1 |
| Wolfi | open-webui | no fix |
| Wolfi | superset-6.0 | 6.0.0-r13 |
| Wolfi | superset-6.1 | 6.1.0-r6 |
| openSUSE Leap 16.0 | python-Pillow | 11.3.0-160000.8.1 |