Python Pillow CVE-2026-59203

The target application must accept attacker-influenced EPS input and pass it to Pillow's Image.open() (or otherwise invoke EpsImagePlugin), running an affected version 12.0.0-12.2.0. The specific trigger is a crafted EPS file containing a %%BeginBinary directive with a negative byte count, which drives the parser to seek backwards and re-read the same directive endlessly. Limiting factors: exploitation is impossible if the deployment never handles EPS files or if image parsing is constrained to a non-EPS format allowlist; there is no authentication or user-interaction requirement beyond delivering the file, and impact is limited to availability (a hang/CPU exhaustion), not code execution or data disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent for an availability-only DoS: no confidentiality or integrity impact, low complexity, and no privileges or interaction beyond getting the target to parse the file. The real-world network reachability depends on whether the deploying application actually accepts and opens EPS input - many deployments never enable or expose EPS parsing, which meaningfully narrows exposure below what AV:N alone implies. No EPSS score, SSVC decision, or KEV entry was provided; absence of KEV and of a weaponized exploit suggests this is not under active exploitation. This is a legitimate availability priority for services that ingest untrusted images (single-request hang of a worker/thread), but it is not a code-execution or data-exposure issue, so it should be triaged as a moderate DoS-hardening fix rather than an emergency.

An attacker uploads a crafted EPS file (or supplies one via a URL the service fetches) to any endpoint that thumbnails or converts images with Pillow. When the backend calls Image.open() on the file, the EPS parser enters an infinite loop and the worker process pegs a CPU core and never returns, so repeated submissions exhaust the worker pool and take the service offline. The fix PR contains a test reproducer showing the exact trigger (a '-1' byte count), so the trigger condition is publicly documented.