Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-14T15:42:15 Pillow: Pillow: Denial of Service via out-of-bounds write in image processing 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-190

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit a vulnerability in the library's image processing functions, specifically when handling image coordinates near certain limits. This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable.

The impact is limited to denial of service. While the underlying issue is a heap out-of-bounds write, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Under investigation exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Under investigation lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Under investigation lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Under investigation lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat AI Inference Server Affected rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-gaudi-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-spyre-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Under investigation python-pillow Red Hat Enterprise Linux 7 Under investigation python-pillow Red Hat Enterprise Linux 8 Under investigation python-pillow Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-nlp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-tgis-serving-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-autogluon-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llm-d-kv-cache-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Under investigation python-pillow Red Hat Satellite 6 Under investigation satellite:el8/python-pillow https://www.cve.org/CVERecord?id=CVE-2026-59199 https://nvd.nist.gov/vuln/detail/CVE-2026-59199 https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b https://github.com/python-pillow/Pillow/pull/9703 https://github.com/python-pillow/Pillow/releases/tag/12.3.0 https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4