Memory Exhaustion Vulnerability in Pillow Python Imaging Library
CVE-2026-59200

7.5HIGH

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
14 July 2026

What is CVE-2026-59200?

The Pillow Python imaging library, versions 5.1.0 through 12.2.0, contains a vulnerability in the PdfParser.PdfStream.decode() method, where it improperly handles decompression of PDF streams. Specifically, the method calls zlib.decompress() with the buffer size set to the length of the PDF stream without imposing a limit on the size of the decompressed output. This oversight can be exploited through crafted FlateDecode PDF streams, leading to excessive memory consumption and potential denial of service. Users are advised to upgrade to version 12.3.0 or later for a fix.

Affected Version(s)

Pillow >= 5.1.0, < 12.3.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/9718
x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/f7a31ea75e...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.