PyPI/pillow CVE-2026-59198: medium 6.5, EPSS 0.31%

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Action: Upgrade pillow to 12.3.0 or later.

pip install pillow==12.3.0

Affected

Fixed versions

Sources

• osv: GHSA-fj7v-r99m-22gq
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq
• https://nvd.nist.gov/vuln/detail/CVE-2026-59198
• https://github.com/python-pillow/Pillow/pull/9709
• https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0

CVE-2026-59198 · published 2026-07-20T23:09:36Z · modified 2026-09-10T03:50:51.891240357Z · JSON