Heap Out-of-Bounds Write in Pillow Python Imaging Library

CVE-2026-59197

What is CVE-2026-59197?

The Pillow library, a widely used Python imaging library, contains a vulnerability where its public rank-filter API can trigger a heap out-of-bounds write. This vulnerability occurs when a very large odd filter size is provided, compromising memory safety. The issue stems from ImageFilter.RankFilter.filter() method's flawed validation mechanism combined with unchecked signed integer arithmetic, leading to the potential exploitation of memory operations. This vulnerability is resolved in version 12.3.0.

References