Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-59200

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

python-pillow Pillow

  • >= 5.1.0, < 12.3.0affected

References