Python Pillow CVE-2026-59197

Exploitation requires that the application pass an attacker-influenced filter size into ImageFilter.RankFilter (or its MedianFilter/MinFilter/MaxFilter subclasses), or otherwise reach im.expand() with an attacker-controlled margin, on Pillow before 12.3.0; the concrete trigger is a very large odd filter size (the regression test uses 23171) whose size//2 margin overflows signed-int arithmetic in native ImagingExpand(). What limits exploitation: in typical deployments the rank-filter size is a fixed developer constant, not user-supplied, so the vulnerable path is unreachable unless the app explicitly exposes the size parameter to untrusted input; there is no authentication or user-interaction requirement at the Pillow level (PR:N/UI:N), but reachability is the real gating factor rather than raw network access.

The NVD CVSS 3.1 base is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H): network vector, no privileges, no user interaction, low integrity impact and high availability impact, with no confidentiality loss - consistent with a memory-corruption bug that most reliably yields a crash/DoS and only conditionally something more. No EPSS score, KEV entry, or POC was supplied, so exploitation-in-the-wild signal is absent: treat this as 'no public exploit identified at time of analysis,' not a low-risk issue by default. The key caveat is the AV:N/PR:N/UI:N rating assumes an attacker can supply the filter size; in practice the rank-filter size is almost always a fixed, developer-chosen constant, not attacker-controlled input, so real-world reachability depends heavily on whether an application exposes RankFilter/MedianFilter/MinFilter/MaxFilter size to untrusted callers. Where it is exposed, this is a genuine remote memory-corruption priority; where size is hard-coded (the common case), practical risk drops to near-zero regardless of the high base score. Verify the data flow in your own code before triaging as network-exploitable.

An application exposes an image-processing endpoint that lets a user choose a rank/median filter radius, and passes that value into ImageFilter.RankFilter without an upper bound. An attacker submits a very large odd filter size, causing image.expand() to trigger the unchecked signed-int overflow in ImagingExpand() and a heap out-of-bounds write, crashing the worker process (denial of service) with the potential for further memory corruption. No public POC is identified at time of analysis, though the fixing PR includes a regression test demonstrating the triggering size (23171).