Pillow CVE-2026-59205

Exploitation requires the application to invoke ImageCms.ImageCmsTransform.apply(im, imOut) where the supplied output image imOut has a mode that does not match the transform's declared output_mode (and, in the unpatched code path, an input im whose mode differs from input_mode) - e.g., applying a transform whose output_mode is RGB while passing an RGBA or LAB output image, exactly as shown in the fix's regression tests (t.apply(hopper('RGBA')) and t.apply(hopper('LAB'), hopper('RGBA'))). This is NOT default remote-unauthenticated exploitation of every Pillow install: it is limited to code paths that call the ImageCms transform apply() API and that allow the image mode/geometry to diverge from the transform's declared modes, typically when modes are driven by untrusted image input. Applications that never use ImageCms color transforms, or that always pass correctly mode-matched buffers, are not exposed.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates this network, low-complexity, unauthenticated with high availability impact and no confidentiality/integrity impact - consistent with a crash/DoS classification. That vector should be treated cautiously: exploitation is not a raw wire-protocol flaw but requires an application to call ImageCms.ImageCmsTransform.apply() with a mode-mismatched output image, so 'network' reachability depends on the application deriving image modes from untrusted input; AC:L is optimistic given the specific mode-mismatch precondition. The description's phrase 'controlled native heap corruption' suggests impact could exceed pure availability (potential integrity/code-execution consequences), which the NVD C:N/I:N scoring does not capture - verify with vendor before assuming DoS-only. No EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified. This is not in CISA KEV and no POC beyond the regression test in the fix commit is provided, so real-world priority is moderate: patch promptly given Pillow's massive deployment footprint, but there is no evidence of active exploitation.

An application performs ICC color-management on user-uploaded images and passes a pre-allocated output image whose mode is influenced by attacker-controlled input to ImageCmsTransform.apply(); the mismatched buffer geometry triggers an out-of-bounds write in the native lcms2 transform, crashing the worker process (denial of service) and potentially corrupting adjacent heap structures. Given AV:N/AC:L in the NVD vector, a remote user could repeatedly submit crafted images to exhaust or crash the service. No public exploit code has been identified; only the regression test accompanying the fix demonstrates the mode-mismatch trigger.