What is the CVSS score of CVE-2026-59199?

CVE-2026-59199 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Python Pillow are affected by CVE-2026-59199?

Python Pillow image processing libraries (versions before 12.3.0) contain a vulnerability in coordinate handling that causes denial of service and potential memory corruption when processing…. A patch is available.

How to fix or mitigate CVE-2026-59199?

Within 24 hours, identify all applications using Python Pillow and determine which process image coordinates from external or untrusted sources. Within 7 days, upgrade to Pillow 12.3.0 or later in development and staging; if immediate upgrade is not feasible, implement strict coordinate validation to reject values outside the safe integer range (-2,147,483,648 to 2,147,483,647). Within 30 days, complete production deployment of Pillow 12.3.0 or later across all affected systems and verify all functionality remains intact.

Python Pillow CVE-2026-59199

EUVD-2026-43739 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-14 GitHub_M

Python Buffer Overflow Integer Overflow Pillow

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Impact is a crash (A:H, no C/I); AC:H because it requires the app to forward attacker-controlled coordinates and specific near-INT32-boundary values, so reachability is conditional though unauthenticated.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:31 vuln.today

Analysis Generated

Jul 14, 2026 - 16:31 vuln.today

CVE Published

Jul 14, 2026 - 15:42 cve.org

HIGH 7.5

DescriptionCVE.org

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

Articles & Coverage 1

News 14 New Python Vulnerabilities - 14 High Severity, 1 With POC Jul 15, 2026

AnalysisAI

Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±231), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach app endpoint accepting image coordinates

Delivery

Submit box near ±2**31 limits

Exploit

Overflow 32-bit size subtraction in libImaging

Execution

Heap out-of-bounds write in paste/fill

Impact

Worker crash / denial of service

Access

Reach app endpoint accepting image coordinates

Delivery

Submit box near ±2**31 limits

Exploit

Overflow 32-bit size subtraction in libImaging

Execution

Heap out-of-bounds write in paste/fill

Impact

Worker crash / denial of service

Vulnerability AssessmentAI

Exploitation	The vulnerable code path is reached only when an application passes a box/coordinate tuple containing values near the signed 32-bit integer limits (approximately ±2147483648) into Image.paste(), Image.crop(), or Image.alpha_composite() on a Pillow build prior to 12.3.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, C:N/I:N) rates this 7.5 as a network, unauthenticated availability issue - but that network reachability is conditional: exploitation requires an application to pass attacker-influenced coordinates directly into paste/crop/alpha_composite, which is not a universal usage pattern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A web service lets users crop or composite uploaded images by submitting box coordinates via an API. An attacker submits a request with coordinates near the 32-bit limits (e.g. …
Remediation	Vendor-released patch: 12.3.0 - upgrade to Pillow 12.3.0 or later (pip install --upgrade 'Pillow>=12.3.0'), which replaces the overflow-prone 32-bit size arithmetic with int64_t math (commit ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b, PR https://github.com/python-pillow/Pillow/pull/9703). … Detailed patch versions, workarounds, and compensating controls in full report.