CVE-2026-59197

pillow: Pillow is a Python imaging library

CVE-2026-59197 is fixed in 18 products on 1 platform, first by python3-pil 9.0.1-1ubuntu0.6, released July 14, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
9.1
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0045
38th percentile

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.

Where it's fixed

ProductFixed inFixReleased
Linux
mingw32-python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw32-python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw64-python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw64-python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
pillow · Debian 14 12.3.0-1 DEBIAN-CVE-2026-59197 Jul 25, 2026
python-Pillow · opensuse-leap 16.0 11.3.0-160000.8.1 OPENSUSE-SU-2026:21544-1 Aug 10, 2026
python-Pillow · sles 15.6 9.5.0-150400.5.25.1 SUSE-SU-2026:3268-1 Jul 27, 2026
python-Pillow · sles 15.7 9.5.0-150400.5.25.1 SUSE-SU-2026:3268-1 Jul 27, 2026
python-Pillow · sles 16.0 11.3.0-160000.8.1 SUSE-SU-2026:23228-1 Aug 10, 2026
python-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow · rocky 8 0:5.1.1-23.el8_10 RLSA-2026:48021 Jul 31, 2026
python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python-pillow-debugsource · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow-debugsource · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pil · Ubuntu 22.04.1 LTS (jammy) 9.0.1-1ubuntu0.6 python3-pil 9.0.1-1ubuntu0.6 Jul 14, 2026
python3-pil · Ubuntu 24.04.5 LTS (noble) 10.2.0-1ubuntu1.4 python3-pil 10.2.0-1ubuntu1.4 Jul 14, 2026
python3-pil · Ubuntu 26.04.1 LTS (resolute) 12.1.1-2ubuntu1.4 python3-pil 12.1.1-2ubuntu1.4 Jul 14, 2026
python3-pil.imagetk · Ubuntu 22.04.1 LTS (jammy) 9.0.1-1ubuntu0.6 python3-pil.imagetk 9.0.1-1ubuntu0.6 Jul 14, 2026
python3-pil.imagetk · Ubuntu 24.04.5 LTS (noble) 10.2.0-1ubuntu1.4 python3-pil.imagetk 10.2.0-1ubuntu1.4 Jul 14, 2026
python3-pil.imagetk · Ubuntu 26.04.1 LTS (resolute) 12.1.1-2ubuntu1.4 python3-pil.imagetk 12.1.1-2ubuntu1.4 Jul 14, 2026
python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-devel · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-devel · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-devel · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-devel · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-devel · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-doc · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-doc · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-doc · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-qt · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-tk · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-tk · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-tk · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-tk-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.