CVE-2026-59205: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Pillow’s public ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger
controlled native heap corruption when the caller supplies an output image whose
mode does not match the transform’s declared output mode.
For example, a transform built as RGBA -> RGBA can be applied to an L output
image. Pillow checks dimensions only, then calls LittleCMS with the output row
pointer. LittleCMS writes RGBA-sized rows into a 1-byte-per-pixel L image row.
References
- github.com/advisories/GHSA-9hw9-ch79-4vh6
- github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml
- github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
- github.com/python-pillow/Pillow/pull/9715
- github.com/python-pillow/Pillow/releases/tag/12.3.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
- nvd.nist.gov/vuln/detail/CVE-2026-59205
Code Behaviors & Features
Detect and mitigate CVE-2026-59205 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →