CVE-2026-59203
MEDIUMPillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Title source: cnaDescription
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.
References (4)
Core 4
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/python-pillow/Pillow/pull/9708
X_Refsource_Confirm x_refsource_confirm
https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798
X_Refsource_Misc x_refsource_misc
https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
X_Refsource_Misc x_refsource_misc
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
Scores
CVSS v3
5.3
EPSS
0.0040
EPSS Percentile
32.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-835
Status
published
Products (3)
pypi/pillow
12.0.0 - 12.3.0PyPI
python/pillow
12.0.0 - 12.3.0
python-pillow/Pillow
>= 12.0.0, < 12.3.0
Published
Jul 14, 2026
Tracked Since
Jul 14, 2026