These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-59200 is a vulnerability in Pillow, a Python imaging library. The issue arises from the PdfParser.PdfStream.decode() function in PIL/PdfParser.py, which calls zlib.decompress() with a bufsize set to the PDF stream Length field without bounding the decompressed output size. This allows a crafted FlateDecode PDF stream to exhaust memory from a small file. The vulnerability is fixed in version 12.3. [truncated]
CVE-2026-59197 is a high-severity vulnerability in Pillow, a Python imaging library. A heap out-of-bounds write can occur when using the public rank-filter API with a very large odd filter size. This issue is fixed in version 12.3.0. The vulnerability exists due to ImageFilter.RankFilter.filter() calling image.expand(size // 2, size // 2) before rank-filter size validation, leading to unchecked signed int [truncated]
The Pillow library, a Python imaging library, is vulnerable to a memory disclosure issue. When loading an uncompressed McIdas AREA image, attacker-controlled header words can set a row stride smaller than the natural row width. This can cause pixel access functions like Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. Developers an [truncated]
CVE-2026-59204 is a high-severity vulnerability in Pillow, a Python imaging library. The issue allows a crafted JPEG2000 file to cause high transient memory usage, potentially leading to out-of-memory failures during decoding. This vulnerability exists in Pillow versions from 8.2.0 through 12.2.0 and is fixed in version 12.3.0. The vulnerability has a high CVSS score of 8.7, indicating a significant risk [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-06T19:17:08.830Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects Pillow, a Python imaging library, on Windows systems. The vulnerability class is related to improper command construction and execution. The likely operational impact includes poten [truncated]
The Pillow Python imaging library, prior to version 12.3.0, contains a vulnerability in the FontFile.compile() function. This function assembles per-glyph images into a combined bitmap using Image.new('1', (xsize, ysize)) without calling Image._decompression_bomb_check(). This omission allows a malicious font to trigger excessive allocation during conversion or saving, potentially leading to a denial-of-s [truncated]
CVE-2026-42311 affects Pillow, a Python imaging library, when it processes malicious PSD files. According to the advisory and NVD record, versions 10.3.0 through before 12.2.0 are vulnerable to memory corruption, which can result in a crash or arbitrary code execution. The issue is patched in Pillow 12.2.0.
CVE-2026-42310 affects Pillow, the Python imaging library, in versions 4.2.0 through before 12.2.0. According to the NVD record and the linked GitHub advisory materials, an attacker can supply a malicious PDF that causes the process to hang indefinitely and consume 100% CPU, leaving the application unresponsive. The issue is classified as CWE-835 and was fixed in Pillow 12.2.0.
CVE-2026-42309 is a medium-severity heap buffer overflow in Pillow's coordinate handling. Nested lists passed to APIs that accept coordinates could be recursively unpacked beyond the allocated buffer. The issue affects Pillow from 11.2.1 up to, but not including, 12.2.0, and is fixed by validating coordinate lists to contain exactly two numeric values.
CVE-2026-42308 is a Medium-severity issue in Pillow, the Python imaging library, where excessively large glyph advance values can cause an integer overflow while Pillow tracks the current position. The issue is patched in Pillow 12.2.0. The available source record ties the weakness to CWE-190 and points to the 12.2.0 release and associated GitHub security advisory.
