VDB

CVE-2026-59204

CVE-2026-59204 PUBLISHED CVSS 8.7 HIGH

Reported by GitHub_M · Published July 14, 2026

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.

Risk Scores

CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
python-pillowPillow>= 8.2.0, < 12.3.0
chainguardsuperset-6.10, 0, 0
chainguardtritonserver-backend-vllm-cuda-13.00, 0
chainguardtensorflow-gpu-jupyter0, 0
wolfisuperset-6.10, 0, 0
chainguardsuperset-fips-6.10
chainguardopenstack-horizon-2026.1-fips0, 0, 0
python-pillowPillow>= 8.2.0, < 12.3.0, >= 8.2.0, < 12.3.0
chainguardopenstack-horizon-2025.20, 0, 0
chainguardopen-webui0, 0, 0
wolfisuperset-6.00, 0, 0
chainguardlmcache-cuda-12.80
chainguardtext-generation-inference0, 0
chainguardopenstack-horizon-2025.2-fips0, 0, 0
chainguardsuperset-6.00, 0, 0
chainguardopenstack-horizon-2026.10, 0, 0
chainguardmlflow0, 0, 0
wolfimlflow0, 0, 0
chainguardlabel-studio0, 0, 0

Timeline

  • Jul 14, 2026 CVE Published
  • Jul 15, 2026 Coalition ESS Score
  • Jul 21, 2026 CVE Updated
  • Aug 7, 2026 EPSS Score
  • Aug 7, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›