{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-59197","sourceIdentifier":"security-advisories@github.com","published":"2026-07-14T17:17:14.487","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0."},{"lang":"es","value":"Pillow es una biblioteca de procesamiento de imágenes de Python. Antes de la versión 12.3.0, la API pública de filtro de rango de Pillow puede desencadenar una escritura fuera de límites en el heap nativo cuando se le proporciona un tamaño de filtro impar muy grande porque ImageFilter.RankFilter.filter() llama a image.expand(size // 2, size // 2) antes de la validación del tamaño del filtro de rango e ImagingExpand() calcula las dimensiones de salida con aritmética de enteros con signo sin verificar. Este problema está solucionado en la versión 12.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-pillow","product":"Pillow","versions":[{"version":"\u003c 12.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-21T18:50:30.849980Z","id":"CVE-2026-59197","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","versionEndExcluding":"12.3.0","matchCriteriaId":"6372231F-529B-45CD-978E-3F2AEFF5F95C"}]}]}],"references":[{"url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/python-pillow/Pillow/pull/9695","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}