Python Pillow CVE-2026-59200

Exploitation requires that the target application actually parses attacker-controlled PDF data through Pillow's PdfParser (i.e., PDF handling is invoked on untrusted input) - the crafted FlateDecode stream must reach PdfStream.decode(). The affected Pillow version must be in the 5.1.0-12.2.x range. No authentication, privileges, or user interaction are required per the CVSS vector (PR:N/UI:N) in a server-side auto-processing context; the key limiting factor is deployment-dependent: if PDFs are only opened from trusted sources, or the application never routes user input into the PDF code path, the vulnerability is not reachable. Success also depends on the host lacking memory limits/sandboxing that would contain the runaway allocation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) reflects a pure availability impact - no confidentiality or integrity loss - reachable without authentication or privileges and with low complexity. That network/no-auth framing is realistic only where an application feeds untrusted PDFs into Pillow (e.g., a web service that renders or thumbnails uploaded PDFs); a desktop or batch tool would effectively require a user to open a malicious file, shifting closer to UI-assisted local delivery. No EPSS score, SSVC decision, or KEV entry was provided; absence of KEV plus no observed public exploit suggests this is not currently subject to mass exploitation. The realistic priority is moderate: it is a memory-exhaustion DoS, not code execution, so impact is service disruption rather than compromise. Teams running multi-tenant or internet-facing services that process user-supplied PDFs with Pillow should treat it as a genuine availability risk; environments that only handle trusted images are low priority. Note the tension between AV:N and the practical need for the application to actually route attacker PDFs into the parser - verify your deployment's exposure before ranking it as network-remote.

An attacker uploads a small (a few kilobytes) PDF containing a FlateDecode stream with a large declared Length to a web service that uses Pillow to render or thumbnail PDFs. When the server calls PdfStream.decode(), zlib inflates the stream into multiple gigabytes, exhausting RAM and causing the worker or host to crash or hang. No public exploit is published, but crafting the malicious PDF is trivial given the disclosed root cause and the test case in the fix PR.