CVE-2026-59205

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2026-07-14

Proof-of-concept exploits (1)

• advisories/GHSA-9hw9-ch79-4vh6

References

• CVE Record
• NVD entry

Related

• CVE-2026-59204
• CVE-2026-59213
• CVE-2026-59203
• CVE-2026-59217
• CVE-2026-59199
• CVE-2026-59220