PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59204 python-pillow CVE debrief

CVE-2026-59204 is a high-severity vulnerability in Pillow, a Python imaging library. The issue allows a crafted JPEG2000 file to cause high transient memory usage, potentially leading to out-of-memory failures during decoding. This vulnerability exists in Pillow versions from 8.2.0 through 12.2.0 and is fixed in version 12.3.0. The vulnerability has a high CVSS score of 8.7, indicating a significant risk to affected systems. Developers and administrators should prioritize updating Pillow to version 12.3.0 or later to mitigate this risk.

Vendor
python-pillow
Product
Pillow
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-21
Advisory published
2026-07-14
Advisory updated
2026-07-21

Who should care

Developers and administrators using Pillow in their applications should be aware of this vulnerability. Given its high CVSS score of 8.7, it is crucial to update to version 12.3.0 or later to mitigate the risk. Additionally, users should be cautious when handling JPEG2000 files from untrusted sources and consider implementing additional security measures to protect against potential exploits.

Technical summary

The vulnerability is caused by the accumulation of total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile in the src/libImaging/Jpeg2KDecode.c file. This allows a crafted tiled JPEG2000 file to force substantially higher transient memory usage, potentially triggering out-of-memory failures during decoding. The issue is specific to Pillow versions 8.2.0 through 12.2.0, and the fix is included in version 12.3.0.

Defensive priority

High priority should be given to updating Pillow to version 12.3.0 or later. Additionally, users should be cautious when handling JPEG2000 files from untrusted sources and consider implementing additional security measures to protect against potential exploits.

Recommended defensive actions

  • Update Pillow to version 12.3.0 or later
  • Validate and sanitize JPEG2000 files before processing
  • Monitor applications for out-of-memory errors
  • Consider implementing memory usage limits for Pillow operations
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-14T16:17:02.227Z and was last modified on 2026-07-21T19:17:12.020Z. The NVD entry is currently Modified. This information is based on the provided source corpus and may not reflect the full scope of affected systems or potential impacts. Users should verify the details with the official CVE record and NVD entry for the most accurate and up-to-date information.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T16:17:02.227Z and has not been modified since then.