CVE-2026-59199

score

2.6

cvss

7.5

epss

0.4%

published

2026-07-14

kev added

—

first seen

2026-10-21

Pillow < 12.3.0 contains a buffer overflow caused by native heap out-of-bounds write in Image.paste(), Image.crop(), or Image.alpha_composite() when given coordinates near signed 32-bit integer limits, letting attackers cause memory corruption, exploit requires crafted image coordinates.