Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-15 | 1 | Disclosure1 |
| 2026-07-20 | 1 | Patch1 |
⚠️ Linux Exploit Intelligence alert: CVE-2026-59197 (CVSS 8.2) Remote attackers could disrupt service or cause a denial of service. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-59197 #Linux #ExploitIntelligence #CyberSecurity #CVE
Post summary
An advisory for CVE-2026-59197 recommends upgrading to a vendor-patched release; no PoC or exploitation evidence is provided.
🚨 HIGH - Pillow rank-filter heap out-of-bounds write via oversized odd filter size (CVE-2026-59197) Pillow contains a flaw in the public ImageFilter.RankFilter.filter() API where processing a very large odd filter size can trigger a native heap out-of-bounds write in the underlying imaging core. The root cause is improper input validation combined with unchecked signed integer arithmetic during image expansion, leading to integer overflow and miscomputed output dimensions in ImagingExpand(). An attacker can exploit this by feeding a crafted image and invoking rank filtering with an oversized odd size in any app/service that exposes Pillow image processing to untrusted input (no special privileges beyond reaching the processing path). Successful exploitation can result in process crashes and potentially arbitrary code execution in the context of the application, enabling service disruption or further compromise. 👉 Affected: Pillow < 12.3.0 | Upgrade to 12.3.0
Post summary
Vulnerability in Pillow (CVE‑2026‑59197) allows a heap out‑of‑bounds write via oversized odd filter sizes; patch is available in version 12.3.0 and no active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | python | pillow | - | - | - |