CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging

Pillow is a Python Imaging Library that provides image processing capabilities. The vulnerability exists within the native C extension libImaging, specifically in the image expansion and filtering code paths.\n\nAn attacker can trigger this vulnerability by providing an extremely large filter size parameter to ranking filters. This input flows from the Python layer into native C functions without sufficient prior validation.\n\nThe resulting calculation causes a signed integer overflow. This leads to severe memory corruption or application crashes.

The root cause lies in src/libImaging/Filter.c within the ImagingExpand function. When an application initializes a filter, the Python layer calculates the margin parameter using floor division.\n\nFor extremely large filter sizes, this division yields a margin value close to INT_MAX. When passed to the C library, the output dimensions are computed via addition and multiplication.\n\nSpecifically, the formula imIn->xsize + 2 * margin overflows the 32-bit signed integer limits. This mathematical wraparound results in a very small dimension value.\n\nConsequently, the library allocates an undersized destination buffer. However, the subsequent copying loop still uses the original large margin, resulting in an out-of-bounds write.

The vulnerable calculation path computes the destination buffer size based on the overflowed dimensions.\n\nc\n/* Vulnerable dimension calculation */\nint xsize = imIn->xsize + 2 * margin;\nint ysize = imIn->ysize + 2 * margin;\n\n/* Allocation of undersized buffer */\nimOut = ImagingNewDirty(imIn->mode, xsize, ysize);\n\n\nThe loop then iterates using the un-overflowed margin to copy pixels.\n\nc\n/* Out-of-bounds copy loop */\nfor (y = 0; y < margin; y++) {\n for (x = 0; x < margin; x++) {\n imOut->image[y][x] = imIn->image[...];\n }\n}\n\n\nThe patch attempted to check bounds but introduced a division-by-zero error.\n\nc\n/* Patched boundary check introducing regression */\nif (margin > INT_MAX / (margin * (int)sizeof(FLOAT32))) {\n return (Imaging)ImagingError_ValueError(\"filter size too large\");\n}\n

An attacker can exploit this flaw by submitting images or filter size parameters designed to trigger the overflow. This allows sequential overwriting of heap data with pixel values derived from the input image.\n\nControl over pixel values enables targeted heap corruption. This can lead to remote code execution in contexts where untrusted input dictates filter dimensions.\n\nAdditionally, the patch regression allows a straightforward denial of service attack. Passing a filter size of 1 translates to a margin of 0, triggering the division-by-zero trap.

Users should upgrade to Pillow version 12.3.0 or later to resolve the heap out-of-bounds write. This release contains validation checks that prevent large values from reaching the C execution layer.\n\nFor systems where upgrading is not immediately possible, strict input validation should be enforced. Applications should restrict filter size parameters to reasonable boundaries.\n\nFurthermore, the division-by-zero issue can be mitigated by ensuring that the margin parameter is non-zero before invoking the expansion functions.