BIT-pillow-2026-59205

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-59205.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-pillow-2026-59205

Aliases

Published

2026-07-15T08:55:02Z

Modified

2026-09-08T08:48:18Z

Summary

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

Details

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Database specific

{
    "cpes": [
        "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / pillow

Package

Name: pillow
Purl: pkg:bitnami/pillow

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

12.3.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-59205.json"