CVE-2026-59200

🗓️ 14 Jul 2026 16:09:05Reported by GitHub_MType

Summary: Pillow 5.1.0–12.3.0 contains a memory exhaustion vulnerability in PdfParser.PdfStream.decode() caused by calling zlib.decompress() with an unbounded output size (bufsize set to the PDF stream Length). This can allow a crafted FlateDecode ...

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-59200 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()	14 Jul 202616:09	–	cvelist
EUVD	EUVD-2026-43753	14 Jul 202616:09	–	euvd
NVD	CVE-2026-59200	14 Jul 202617:17	–	nvd
OSV	CVE-2026-59200 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()	14 Jul 202616:09	–	osv
Positive Technologies	PT-2026-58106	14 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-59200 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()	14 Jul 202616:09	–	vulnrichment

Vulners

Node

python-pillow pillowRange5.1.0–12.3.0

[
  {
    "vendor": "python-pillow",
    "product": "Pillow",
    "versions": [
      {
        "version": ">= 5.1.0, < 12.3.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/python-pillow/Pillow/releases/tag/12.3.0
github	www.github.com/python-pillow/Pillow/pull/9718
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565
github	www.github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09

14 Jul 2026 20:18Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

SSVC