CVE-2026-59205

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

Affected

python-pillow · Pillow

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2026-07-14

Proof-of-concept exploits (1)

• advisories/GHSA-9hw9-ch79-4vh6

Security advisories

• python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6
• python-pillow/Pillow/pull/9715

References

• CVE Record
• NVD entry