CVE-2026-59197

score

2.6

cvss

8.2

epss

0.4%

published

2026-07-14

kev added

—

first seen

2026-10-21

Pillow < 12.3.0 contains a buffer overflow caused by unchecked signed int arithmetic in ImageFilter.RankFilter.filter() during large odd filter size expansion, letting attackers trigger native heap out-of-bounds write, exploit requires crafted image input.