CVE-2026-59203
Fixed in a distro release EPSS <1%CVSS 5.3
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | label-studio | 1.23.0-r11 |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | mlflow | 3.14.0-r2 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | open-webui | 0.10.2-r1 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r4 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r5 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260630-r2 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260630-r2 |
| Chainguard | superset-6.0 | 6.0.0-r13 |
| Chainguard | superset-6.1 | 6.1.0-r6 |
| Chainguard | superset-6.1-iamguarded-compat | no fix |
| Chainguard | superset-fips-6.1 | 6.1.0-r5 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r7 |
| Chainguard | text-generation-inference | 3.3.7-r20 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r11 |
| Debian 14 | pillow | 12.3.0-1 |
| Ubuntu 26.04 LTS | pillow | no fix |
| Wolfi | mlflow | 3.14.0-r2 |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | open-webui | 0.10.2-r1 |
| Wolfi | superset-6.0 | 6.0.0-r13 |
| Wolfi | superset-6.1 | 6.1.0-r6 |
| Wolfi | superset-6.1-iamguarded-compat | no fix |