CVE-2026-59197

What it actually does

CVE-2026-59197 is a native memory-corruption flaw in Pillow before 12.3.0. The public ImageFilter.RankFilter.filter() path expands an image using image.expand(size // 2, size // 2) before validating the rank-filter size. With a very large odd filter size, ImagingExpand() performs unchecked signed integer arithmetic when calculating output dimensions, which can overflow and lead to a heap out-of-bounds write in native code. The most reliable impact is process crash or denial of service, with limited integrity impact possible because memory adjacent to the heap allocation may be overwritten. The CVSS vector indicates network-reachable, unauthenticated, low-complexity exploitation where an application exposes attacker-controlled image-processing parameters or applies rank filters to untrusted input.

Why it matters to the business

Applications, automation platforms, APIs, and worker services that use Pillow to process untrusted images or user-controlled filter parameters can be crashed remotely, disrupting image ingestion, document processing, thumbnail generation, automation workflows, or AI/automation assistant features that depend on image handling. Because exploit code is reportedly available and the issue has been public for 28 days, internet-facing or multi-tenant services that accept image uploads should treat this as urgent even though it is not currently listed in CISA KEV and is not known to be used in ransomware campaigns. Organizations using affected Red Hat Ansible Automation Platform, Lightspeed, or Red Hat python-pillow/python3.12-pillow packages should prioritize vendor updates to avoid operational outages and potential data-processing corruption.

How an attack unfolds

An attacker first identifies an application endpoint, job queue, plugin, or automation workflow that invokes Pillow's rank-filter API on data or parameters influenced by the attacker. They then submit a crafted request, uploaded image, or processing job that causes the application to call ImageFilter.RankFilter.filter() with a very large odd filter size. Before Pillow validates whether the rank-filter size is acceptable, the library attempts to expand the image borders using that size. The native ImagingExpand() routine calculates the expanded dimensions using signed integers without adequate overflow checks. The oversized calculation wraps or becomes inconsistent with the actual allocation, and subsequent image expansion writes beyond the heap buffer. In typical exploitation, the affected Python process crashes, killing a web worker, task worker, automation service, or background processor. More advanced exploitation may attempt to shape heap memory to corrupt adjacent data, but exploitation reliability beyond denial of service depends heavily on allocator behavior, platform hardening, process architecture, and application-specific call patterns.

How to fix it

Upgrade Pillow and vendor-packaged Pillow builds to fixed versions. The upstream fix is Pillow 12.3.0 or later. For Red Hat packages, apply RHSA-2026:50340 and ensure the following or later fixed builds are installed where applicable: python3.12-pillow 12.3.0-1.el8ap on el8, python3.12-pillow 12.3.0-1.el9ap on el9, python-pillow 12.3.0-1.el8pc on el8, and python-pillow 12.3.0-1.el9pc on el9. For Red Hat Ansible Automation Platform components, update to the fixed RHSA-2026:50340 builds: ansible-automation-platform 26/hub-rhel9:1785753568, ansible-automation-platform-26/lightspeed chatbot-rhel9:1785646188, and ansible-automation-platform-27/lightspeed chatbot-rhel9:1785426734. If immediate patching is not possible, restrict or disable user-controlled rank-filter operations, enforce strict server-side bounds on filter sizes before calling Pillow, reject extremely large image dimensions and transformation parameters, isolate image-processing workers with memory and CPU limits, and run image processing in low-privilege sandboxed processes or containers.

How to confirm the fix worked

Confirm the installed Pillow version is 12.3.0 or later, or that the operating-system package version matches the relevant fixed vendor build. For Python environments, check package inventories using commands such as python -c "import PIL; print(PIL.__version__)" and pip show Pillow, while also checking virtual environments, containers, build images, serverless bundles, and embedded application dependencies. For Red Hat systems, verify updated packages with rpm -q python-pillow python3.12-pillow and confirm RHSA-2026:50340 has been applied through the organization’s patch tooling. Validate application-level mitigation by confirming that user-supplied or externally derived rank-filter sizes are rejected above a safe maximum and that image-processing workers remain stable when presented with oversized or malformed transformation requests in a controlled test environment. Rebuild and redeploy containers or application artifacts that vendor Pillow so runtime images do not continue using a vulnerable bundled wheel or RPM layer.

Typical attack path

1. Discover an application, API, automation component, or processing pipeline that uses Pillow for image filtering or transformations.
2. Determine or infer whether rank filters can be applied using attacker-controlled parameters, presets, templates, uploaded content, or queued jobs.
3. Submit an image-processing request that triggers ImageFilter.RankFilter.filter() with a very large odd filter size.
4. Cause Pillow to call image.expand(size // 2, size // 2) before validating the rank-filter size.
5. Trigger signed integer overflow or invalid dimension calculation inside native ImagingExpand().
6. Cause a heap out-of-bounds write, typically resulting in a crash of the Python process or worker service.
7. Repeat requests to create sustained denial of service, job-processing failures, service restarts, or degraded availability.

How to detect it

Look for evidence of exploitation in application logs, web/API gateway logs, worker logs, container orchestration events, crash dumps, and host telemetry from systems that process images with Pillow. Useful signals include repeated requests to image transformation endpoints containing unusually large odd numeric values for filter, rank filter, kernel, size, radius, or similar parameters; Python processes exiting with segmentation faults, aborts, or heap corruption shortly after image-processing requests; container or service restarts tied to image upload or transformation workloads; and job queues with failed image-processing jobs using extreme filter-size parameters. Review Python tracebacks and application errors referencing PIL.ImageFilter, ImageFilter.RankFilter, RankFilter.filter, image.expand, or ImagingExpand. Host-level telemetry may show python, python3, gunicorn, uwsgi, celery, rq, or automation-worker processes crashing with SIGSEGV or allocator errors. Because exploitation may produce only a crash and no persistent artifact, correlate request logs immediately preceding crashes with uploaded files, user agents, source IPs, and transformation parameters. No public threat actors are named for this vulnerability in the provided data, and it is not currently in KEV, but exploit availability warrants retroactive hunting over the full period since publication.

• PIL.ImageFilter
• ImageFilter.RankFilter
• RankFilter.filter
• ImagingExpand
• image.expand
• Segmentation fault (core dumped)
• SIGSEGV
• malloc(): corrupted top size
• malloc(): invalid size
• free(): invalid pointer
• corrupted double-linked list
• Fatal Python error
• python.*SIGSEGV
• python3.*SIGSEGV
• filter_size=
• rank_filter
• RankFilter
• ImageFilter
• Pillow
• PIL

What your security team should do

• Prioritize patching internet-facing, multi-tenant, or queue-driven services that process untrusted images or expose image transformation parameters.
• Inventory all Python applications, containers, automation platform components, and virtual environments for Pillow versions earlier than 12.3.0.
• Apply RHSA-2026:50340 for affected Red Hat Ansible Automation Platform, Lightspeed, python-pillow, and python3.12-pillow packages.
• Add application-side validation to cap rank-filter size and image dimensions before invoking Pillow APIs, even after upgrading.
• Harden image-processing services by running them with least privilege, resource limits, crash isolation, and automatic but rate-limited worker recovery.
• Review recent crashes, segmentation faults, container restarts, and image-processing errors from the past 28 days for signs of attempted exploitation.
• Create detection logic for repeated image-processing requests followed by Python worker crashes, especially where request parameters include unusually large odd filter or rank-filter sizes.
• Ensure SBOMs and dependency scanners cover vendored Python wheels, container layers, and embedded copies of Pillow, not only system packages.