CVE-2026-59203

EUVD-2026-43741
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 48.63%
Affected Products (NVD)
VendorProductVersion
pythonpillow
12.0.0 ≤
𝑥
< 12.3.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pillow
bookworm
9.4.0-1.1+deb12u1
fixed
bookworm (security)
9.4.0-1.1+deb12u1
fixed
bullseye
8.1.2+dfsg-0.3+deb11u2
fixed
bullseye (security)
8.1.2+dfsg-0.3+deb11u3
fixed
forky
12.3.0-1
fixed
sid
12.3.0-1
fixed
trixie
11.1.0-5+deb13u4
fixed
trixie (security)
11.1.0-5+deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pillow
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
pillow-python2
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
Common Weakness Enumeration
References
https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
https://github.com/python-pillow/Pillow/pull/9708
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798
https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798