{"uuid": "c6ee7f82-b4f6-4a17-b840-a28d764834fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59203", "type": "seen", "source": "https://gist.github.com/alon710/afd430e951c08264a9a3f3da451132a3", "content": "# CVE-2026-59203: CVE-2026-59203: Denial of Service via Infinite Loop in Pillow EPS Image Parser\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59203\n\n## Summary\nA denial-of-service (DoS) vulnerability in Pillow (Python Imaging Library) versions 12.0.0 through 12.2.0 allows unauthenticated remote attackers to trigger 100% CPU utilization and hang the processing thread. The issue occurs within the Encapsulated PostScript (EPS) image parser (PIL/EpsImagePlugin.py) due to missing validation on the byte count parsed from %%BeginBinary: comments, allowing negative values to cause an infinite backward stream seek loop. This formatting-level state-looping issue occurs during the initial format sniffing phase inside Image.open() and does not require the system Ghostscript interpreter to be executed or present. It is resolved in version 12.3.0.\n\n## TL;DR\nUnvalidated negative byte counts in Pillow's EPS image parser trigger an infinite backward stream-seek loop, resulting in 100% CPU utilization and application hang without requiring image rendering or a Ghostscript installation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.0039 (Percentile: 31.40%)\n- **Impact**: Denial of Service (Thread Hang / CPU Exhaustion)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (python-pillow) version 12.0.0 through 12.2.0\n- **Pillow**: >= 12.0.0, < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade to Pillow version 12.3.0 or higher.\n- Restrict accepted formats when calling Image.open() to prevent automatic sniffing from executing the EPS parser.\n- Reject file uploads starting with PostScript headers (%!PS) at the web gateway or load balancer.\n- Isolate worker processes utilizing limits on containerized CPU and memory allocation to contain infinite-loop exploitation.\n\n**Remediation Steps:**\n1. Audit the environment to confirm the installed Pillow version using: pip show Pillow\n2. Execute: pip install --upgrade Pillow>=12.3.0 to install the patched package.\n3. Identify all locations utilizing Image.open() and constrain the acceptable format array (e.g., Image.open(f, formats=['PNG', 'JPEG'])).\n4. Ensure applications running image processing logic reside within limited container processes with resource constraints.\n\n## References\n\n- [GitHub Security Advisory GHSA-pg7v-jwj7-p798](https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798)\n- [Fix Commit](https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83)\n- [Pillow Pull Request #9708](https://github.com/python-pillow/Pillow/pull/9708)\n- [Pillow Release 12.3.0](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-59203)\n- [NVD CVE-2026-59203](https://nvd.nist.gov/vuln/detail/CVE-2026-59203)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59203) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T08:31:39.762852Z"}