Medium severity5.3NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-59203
CVE-2026-59203
Description
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pillowPyPI | >= 12.0.0, < 12.3.0 | 12.3.0 |
Affected products
22- Range: 12.0.0 - 12.2.0
- osv-coords19 versionspkg:apk/chainguard/label-studiopkg:apk/chainguard/lmcache-cuda-12.8pkg:apk/chainguard/mlflowpkg:apk/chainguard/open-webuipkg:apk/chainguard/openstack-horizon-2025.2pkg:apk/chainguard/openstack-horizon-2025.2-fipspkg:apk/chainguard/openstack-horizon-2026.1pkg:apk/chainguard/openstack-horizon-2026.1-fipspkg:apk/chainguard/superset-6.0pkg:apk/chainguard/superset-6.1pkg:apk/chainguard/superset-fips-6.1pkg:apk/chainguard/tensorflow-gpu-jupyterpkg:apk/chainguard/text-generation-inferencepkg:apk/chainguard/tritonserver-backend-vllm-cuda-13.0pkg:apk/wolfi/mlflowpkg:apk/wolfi/open-webuipkg:apk/wolfi/superset-6.0pkg:apk/wolfi/superset-6.1pkg:bitnami/pillow
< 1.23.0-r11+ 18 more
- (no CPE)range: < 1.23.0-r11
- (no CPE)range: < 0.5.3-r0
- (no CPE)range: < 3.14.0-r2
- (no CPE)range: < 0.10.2-r1
- (no CPE)range: < 25.5.2_git20260617-r4
- (no CPE)range: < 25.5.2_git20260617-r5
- (no CPE)range: < 25.7.3_git20260630-r2
- (no CPE)range: < 25.7.3_git20260630-r2
- (no CPE)range: < 6.0.0-r13
- (no CPE)range: < 6.1.0-r6
- (no CPE)range: < 6.1.0-r5
- (no CPE)range: < 2.21.0-r7
- (no CPE)range: < 3.3.7-r20
- (no CPE)range: < 25.11-r11
- (no CPE)range: < 3.14.0-r2
- (no CPE)range: < 0.10.2-r1
- (no CPE)range: < 6.0.0-r13
- (no CPE)range: < 6.1.0-r6
- (no CPE)range: >= 12.0.0, < 12.3.0
Patches
Vulnerability mechanics
References
7- github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83nvdPatchWEB
- github.com/python-pillow/Pillow/pull/9708nvdIssue TrackingPatchWEB
- github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-pg7v-jwj7-p798ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59203ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yamlghsaWEB
- github.com/python-pillow/Pillow/releases/tag/12.3.0nvdRelease NotesWEB
News mentions
1- Pillow: Four Denial-of-Service Vulnerabilities Disclosed Together for Python Imaging LibraryVypr Intelligence · Jul 16, 2026