CVE-2026-59203 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

🗓️ 14 Jul 2026 15:43:58Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Pillow EPS parser accepts negative byte count causing infinite loop in Image.open; fixed in 12.3.0.

Reporter	Title	Published	Views	Family All 5
CVE	CVE-2026-59203	14 Jul 202615:43	–	cve
Cvelist	CVE-2026-59203 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service	14 Jul 202615:43	–	cvelist
EUVD	EUVD-2026-43741	14 Jul 202615:43	–	euvd
NVD	CVE-2026-59203	14 Jul 202616:17	–	nvd
Positive Technologies	PT-2026-58091	14 Jul 202600:00	–	ptsecurity

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59203.json
github	www.github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
github	www.github.com/python-pillow/Pillow/pull/9708
github	www.github.com/python-pillow/Pillow/releases/tag/12.3.0
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59203

15 Jul 2026 02:21Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.3

Pillow EPS parser negative byte count infinite loop image open version 12.3.0