Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-14T15:48:39
Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-843
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.
A flaw was found in Pillow, a Python imaging library. This vulnerability allows an attacker to trigger controlled native heap corruption by supplying an output image whose mode does not match the transform's declared output mode when using the ImageCms.ImageCmsTransform.apply API. This can lead to a denial of service (DoS) condition, making the affected system or application unavailable.
The impact is limited to denial of service. While the underlying issue is heap corruption via mode mismatch, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.
Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm.
RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.
Red Hat AI Inference Server 3.2
2026-08-31T00:00:00Z
RHSA-2026:61627
rhaiis/vllm-cuda-rhel9:1787860580
Red Hat AI Inference Server 3.2
2026-08-31T00:00:00Z
RHSA-2026:61628
rhaiis/model-opt-cuda-rhel9:1787772157
Red Hat AI Inference Server 3.2
2026-08-31T00:00:00Z
RHSA-2026:61629
rhaiis/vllm-rocm-rhel9:1787884873
Red Hat AI Inference Server 3.3
2026-08-25T00:00:00Z
RHSA-2026:59518
rhaiis/model-opt-cuda-rhel9:1787601159
Red Hat Enterprise Linux AI 3.3
2026-09-01T00:00:00Z
RHSA-2026:62335
rhelai3/disk-image-cuda-rhel9:1788290314
Red Hat Enterprise Linux AI 3.3
2026-09-01T00:00:00Z
RHSA-2026:62336
rhelai3/bootc-aws-cuda-rhel9:1788273908
Red Hat Enterprise Linux AI 3.3
2026-09-01T00:00:00Z
RHSA-2026:62336
rhelai3/bootc-azure-cuda-rhel9:1788273909
Red Hat Enterprise Linux AI 3.3
2026-09-01T00:00:00Z
RHSA-2026:62336
rhelai3/bootc-cuda-rhel9:1788260684
Red Hat Enterprise Linux AI 3.3
2026-09-01T00:00:00Z
RHSA-2026:62336
rhelai3/bootc-gcp-cuda-rhel9:1788273977
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-automl-rhel9:1786612415
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-autorag-rhel9:1786612637
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-llm-d-kv-cache-rhel9:1787169432
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-mlflow-rhel9:1787226790
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-openvino-model-server-rhel9:1787303251
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1787073866
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1787073873
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1787073459
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1787073611
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1787073451
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1787073451
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-th06-cpu-torch210-py312-rhel9:1787076778
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-th06-cuda130-torch210-py312-rhel9:1787077779
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-th06-rocm64-torch291-py312-rhel9:1787076481
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-training-cuda128-torch29-py312-rhel9:1786611803
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-training-rocm64-torch29-py312-rhel9:1786611435
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9:1786613209
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1787121387
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1787074331
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1787073605
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1787073546
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1787073717
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1787073713
Red Hat OpenShift AI 3.4
2026-08-27T00:00:00Z
RHSA-2026:60520
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1787073593
Red Hat Quay 3.10
2026-08-11T00:00:00Z
RHSA-2026:53520
quay/quay-rhel8:1786395065
Red Hat Quay 3.12
2026-08-10T00:00:00Z
RHSA-2026:52968
quay/quay-rhel8:1786170635
Red Hat Quay 3.15
2026-07-30T00:00:00Z
RHSA-2026:48933
quay/quay-rhel8:1785261506
Red Hat Quay 3.9
2026-08-05T00:00:00Z
RHSA-2026:50931
quay/quay-rhel8:1785950004
Exploit Intelligence
Not affected
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Lightspeed Core
Affected
lightspeed-core/lightspeed-stack-rhel9
Lightspeed Core
Affected
lightspeed-core/rag-tool-cpu-rhel9
Lightspeed Core
Affected
lightspeed-core/rag-tool-cuda-12.9-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-ocp-rag-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-service-api-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-neuron-rhel9
Red Hat AI Inference Server
Affected
rhaiis/vllm-spyre-rhel9
Red Hat AI Inference Server
Will not fix
rhaiis/vllm-tpu-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-cpu-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-gaudi-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-neuron-rhel9
Red Hat AI Inference Server
Affected
rhaii/vllm-spyre-rhel9
Red Hat AI Inference Server
Will not fix
rhaii/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/lightspeed-chatbot-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/hub-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/hub-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Not affected
python-pillow
Red Hat Enterprise Linux 7
Not affected
python-pillow
Red Hat Enterprise Linux 8
Not affected
python-pillow
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-azure-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-caikit-nlp-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-caikit-tgis-serving-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-agent-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-autogluon-server-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-controller-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-router-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-kserve-storage-initializer-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-llama-stack-core-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-llm-d-inference-scheduler-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat Quay 3
Affected
quay/quay-rhel9
Red Hat Satellite 6
Not affected
python-pillow
Red Hat Satellite 6
Not affected
satellite:el8/python-pillow
https://www.cve.org/CVERecord?id=CVE-2026-59205
https://nvd.nist.gov/vuln/detail/CVE-2026-59205
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
https://github.com/python-pillow/Pillow/pull/9715
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6