CVE-2026-59203: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Pillow’s EPS parser (PIL/EpsImagePlugin.py) accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open() to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service.
The issue is triggered during Image.open(), does not require Image.load(), and does not require Ghostscript execution.
Confirmed affected versions: Pillow 12.0.0 through 12.2.0.
References
- github.com/advisories/GHSA-pg7v-jwj7-p798
- github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yaml
- github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
- github.com/python-pillow/Pillow/pull/9708
- github.com/python-pillow/Pillow/releases/tag/12.3.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798
- nvd.nist.gov/vuln/detail/CVE-2026-59203
Code Behaviors & Features
Detect and mitigate CVE-2026-59203 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →