{"uuid": "a4552de9-3f8a-4efe-a9a4-2d7bf43006e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59204", "type": "seen", "source": "https://gist.github.com/alon710/796ee0a4078a7a835fdac3bedcdff5ad", "content": "# CVE-2026-59204: CVE-2026-59204: Denial of Service via Memory Exhaustion in Pillow JPEG2000 Decoder\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59204\n\n## Summary\nA Denial of Service vulnerability exists in the JPEG2000 decoder of Pillow (versions 8.2.0 to 12.2.0) due to memory allocation state accumulation across tiles, leading to rapid process termination.\n\n## TL;DR\nA state accumulation bug in Pillow's JPEG2000 tile decoder allows unauthenticated attackers to crash applications via Out-of-Memory termination using crafted multi-tiled images.\n\n## Technical Details\n\n- **CWE ID**: CWE-789 / CWE-770\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 7.5 (v3.1) / 8.7 (v4.0)\n- **EPSS Score**: 0.00398 (32.21% Percentile)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: None / No Public Exploits\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-pillow/Pillow\n- **Pillow**: >= 8.2.0, < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or later.\n- Enforce format restrictions on Image.open() to disable JPEG2000 decoding.\n- Deploy isolated application processes with memory limit restrictions.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade Pillow>=12.3.0' in your Python environment.\n2. Update your codebase to pass a safe list of formats to the PIL open method: Image.open(stream, formats=['PNG', 'JPEG', 'GIF', 'WEBP']).\n3. Enforce container-level memory constraints using standard orchestration platforms.\n4. Deploy YARA signatures to detect JPEG2000 byte markers at the perimeter.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjc4-5qp5-m44j](https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j)\n- [NVD CVE-2026-59204 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-59204)\n- [Official Security Fix Commit](https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca)\n- [Vulnerability Fix Pull Request (#9704)](https://github.com/python-pillow/Pillow/pull/9704)\n- [Pillow 12.3.0 Release Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-59204)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59204) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T07:31:35.065313Z"}