CVE-2026-59199

What it actually does

Pillow versions prior to 12.3.0 contain a native heap out-of-bounds write in public image coordinate APIs when coordinate values near signed 32-bit integer boundaries are passed to Image.paste(), Image.crop(), or Image.alpha_composite(). In applications where untrusted users can influence image coordinates or image-processing jobs, malformed inputs can corrupt process memory and reliably crash the Python worker or service. The published CVSS impact is availability-only, so denial of service is the primary expected outcome; however, because this is native heap memory corruption, security teams should treat exposed services as higher risk than a typical Python exception bug.

Why it matters to the business

A remote user may be able to crash applications, background workers, thumbnailing pipelines, media-processing services, or APIs that use vulnerable Pillow image operations with attacker-controlled coordinates. This can interrupt customer-facing functionality, delay document or image processing, increase operational load through repeated worker crashes, and create instability in dependent services. Exploit code is reported as available, which increases urgency, although EPSS is currently low and the issue is not listed in CISA KEV or as ransomware-associated.

How an attack unfolds

An attacker first identifies an application endpoint, job queue, plugin, or API workflow that uses Pillow to paste, crop, or alpha-composite images and allows user-controlled image coordinates or geometry-like parameters. The attacker submits an image-processing request with coordinate values near the signed 32-bit integer limits, such as very large positive or negative values. In vulnerable Pillow versions, these values can reach native image-handling code and trigger a heap out-of-bounds write. The immediate effect is typically memory corruption followed by a segmentation fault, abort, or worker process crash. By repeating the request, the attacker can cause sustained denial of service against web workers, asynchronous image processors, or batch conversion services. There is no public indication from the provided data that confidentiality or integrity compromise is expected, but memory corruption crashes should still be investigated carefully.

How to fix it

Upgrade Pillow to version 12.3.0 or later wherever it is used. Rebuild and redeploy application images, virtual environments, serverless packages, and worker containers that vendor or bundle Pillow. If immediate upgrade is not possible, restrict untrusted access to affected image-processing workflows, enforce strict server-side validation of all crop, paste, and compositing coordinates, reject coordinates outside the actual image bounds, and explicitly block values near signed 32-bit integer limits. Do not rely only on client-side validation. Also review transitive dependencies and packaged applications that embed Pillow, because vulnerable versions may be present inside container layers, Python wheels, notebooks, plugins, or offline processing jobs.

How to confirm the fix worked

Confirm that all runtime environments load Pillow 12.3.0 or later, not only that dependency manifests were updated. Use package inventory, software composition analysis, and runtime checks such as `python -c "import PIL; print(PIL.__version__)"`, `pip show Pillow`, `pip freeze | grep -i '^Pillow=='`, or equivalent package-manager queries. Verify rebuilt containers and deployed artifacts do not retain older Pillow wheels in virtual environments or cached layers. Confirm application-side validation rejects extremely large positive or negative coordinates and coordinates outside image dimensions. In non-production test environments, exercise representative image crop, paste, and alpha-composite workflows with boundary-value validation tests to ensure malicious coordinate values are rejected cleanly without process crashes.

Typical attack path

1. Find an application feature that performs image manipulation using Pillow, such as cropping, compositing, avatar processing, document preview generation, or thumbnail creation.
2. Determine whether the feature accepts or derives image coordinates from user-controlled request parameters, metadata, templates, or queued job content.
3. Submit crafted coordinate values near signed 32-bit integer limits to Image.paste(), Image.crop(), or Image.alpha_composite() through the exposed workflow.
4. Trigger native heap memory corruption in a vulnerable Pillow version prior to 12.3.0.
5. Cause the Python process, worker, or container handling the image operation to crash.
6. Repeat the crafted requests or jobs to create persistent service degradation or denial of service.

How to detect it

To determine whether exploitation already occurred, correlate application-layer image-processing requests with process crashes. Review web server, API gateway, WAF, application, worker, and job-queue logs for requests or jobs containing very large positive or negative coordinate values, especially values close to 2147483647 or -2147483648, in parameters related to crop, paste, composite, box, rectangle, x, y, width, height, left, top, right, or bottom. Examine system logs, container logs, supervisor logs, Kubernetes events, and crash reporting systems for Python processes terminating with segmentation faults, SIGABRT, glibc malloc corruption, or native crashes involving Pillow/PIL/_imaging immediately after image-processing activity. Review core dumps and crash traces for frames referencing PIL, Pillow, or the _imaging native extension. Look for repeated crashes from the same source IP, account, session, queue producer, file upload path, or automation client. Because reliable vulnerability-specific payload strings are application-dependent, prioritize behavioral detection: anomalous boundary-value coordinates followed by native Python/Pillow crashes.

• 2147483647
• -2147483648
• 2147483648
• -2147483649
• Image.paste(
• Image.crop(
• Image.alpha_composite(
• PIL.Image
• Pillow
• _imaging
• Segmentation fault
• SIGSEGV
• SIGABRT
• malloc(): corrupted top size
• malloc(): invalid size
• corrupted size vs. prev_size
• free(): invalid next size
• free(): invalid pointer
• Fatal Python error
• core dumped

What your security team should do

• Prioritize upgrading all Pillow installations to 12.3.0 or later, especially internet-facing APIs, upload services, media-processing workers, and document/image conversion pipelines.
• Inventory direct and transitive Pillow usage across repositories, containers, serverless packages, CI images, notebooks, and third-party applications.
• Add or verify server-side bounds checks for all user-influenced image coordinates before calling Image.paste(), Image.crop(), or Image.alpha_composite().
• Monitor application and system logs for Python worker crashes, segmentation faults, allocator corruption messages, and repeated image-processing failures following suspicious requests.
• Review API gateway, WAF, and application logs for requests containing unusually large coordinate, crop, box, x/y, width/height, or geometry parameters near signed 32-bit integer boundaries.
• Restart and redeploy long-running workers after patching to ensure vulnerable native extensions are no longer loaded in memory.
• Because exploit code is available, treat repeated crashes in image-processing paths as potentially malicious until confirmed otherwise, even though EPSS is currently low and the issue is not in CISA KEV.