EUVD-2026-43746Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reachable remotely only when an app feeds untrusted modes into the ImageCms apply() path with a mode mismatch, so AC:H; impact is native heap corruption manifesting primarily as availability loss (A:H), with C/I unconfirmed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 85,213 pypi packages depend on pillow (18,358 direct, 68,183 indirect)
Ecosystem-wide dependent count for version 12.3.0.
DescriptionCVE.org
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.
Articles & Coverage 1
AnalysisAI
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occurs when ImageCms.ImageCmsTransform.apply() is invoked with an output image whose mode does not match the transform's declared output mode, causing an out-of-bounds write in the native color-management code. The pre-fix code only validated the output mode and never validated the input mode, so a mismatched buffer geometry lets the C-level transform write past allocation bounds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to invoke ImageCms.ImageCmsTransform.apply(im, imOut) where the supplied output image imOut has a mode that does not match the transform's declared output_mode (and, in the unpatched code path, an input im whose mode differs from input_mode) - e.g., applying a transform whose output_mode is RGB while passing an RGBA or LAB output image, exactly as shown in the fix's regression tests (t.apply(hopper('RGBA')) and t.apply(hopper('LAB'), hopper('RGBA'))). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates this network, low-complexity, unauthenticated with high availability impact and no confidentiality/integrity impact - consistent with a crash/DoS classification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application performs ICC color-management on user-uploaded images and passes a pre-allocated output image whose mode is influenced by attacker-controlled input to ImageCmsTransform.apply(); the mismatched buffer geometry triggers an out-of-bounds write in the native lcms2 transform, crashing the worker process (denial of service) and potentially corrupting adjacent heap structures. Given AV:N/AC:L in the NVD vector, a remote user could repeatedly submit crafted images to exhaust or crash the service. … |
| Remediation | Vendor-released patch: upgrade Pillow to 12.3.0 or later (pip install --upgrade 'Pillow>=12.3.0'), which adds explicit input-mode and output-mode validation before the native transform runs; see the advisory at https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using Pillow and identify which are running versions prior to 12.3.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today