Is CVE-2026-59200 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59200 being exploited in the wild.

How severe is CVE-2026-59200?

High severity, with a CVSS score of 7.5, published 14 July 2026.

Which products and versions are affected?

pillow (PyPI) >= 5.1.0, < 12.3.0, ECOSYSTEM:introduced=5.1.0,fixed=12.3.0.

Is there a fix for CVE-2026-59200?

Yes. pillow (PyPI): upgrade to 12.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59200 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59200?

Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59200: python-pillow Pillow denial of service in PdfParser

Q: Is there a fix for CVE-2026-59200?

Yes. pillow (PyPI): upgrade to 12.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59200 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59200?

Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59200 · Severity: high · CVSS 7.5 · Published 2026-07-14

Pillow, a popular Python library for image processing, contains a vulnerability in its PDF parsing component. An attacker can provide a specially crafted PDF file that, when opened, consumes massive amounts of server memory (a 'decompression bomb'). This can lead to a denial-of-service by crashing the application or slowing down the entire server, affecting all users.

Technologies: pillow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59200 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59200 being exploited in the wild.
How severe is CVE-2026-59200?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: pillow (PyPI) >= 5.1.0, < 12.3.0, ECOSYSTEM:introduced=5.1.0,fixed=12.3.0.
Is there a fix for CVE-2026-59200?: Yes. pillow (PyPI): upgrade to 12.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59200 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59200?: Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 12.3.0 or later
```
pip install "pillow>=12.3.0"
```

Technical details

The vulnerability exists in `PdfParser.PdfStream.decode()` within `PdfParser.py`. The component calls `zlib.decompress()` using the PDF stream's 'Length' field as the `bufsize` parameter. In Python's zlib implementation, `bufsize` is only an initial buffer hint and does not enforce a maximum limit on the decompressed output. An attacker can craft a PDF with a FlateDecode-compressed stream that expands significantly (e.g., 1 GB from < 1 MB), leading to uncontrolled resource consumption (CWE-400). This is reachable when an application uses `PdfParser` to read untrusted PDF files. The issue is fixed in Pillow version 12.3.0.

Affected products

python-pillow Pillow >= 5.1.0, < 12.3.0

Identifiers

CVE-2026-59200
GHSA-jjj6-mw9f-p565
PYSEC-2026-3495

Timeline

2026-07-07: patched: Fix released in version 12.3.0
2026-07-14: advisory: NVD publication date
2026-07-20: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.