CVE-2026-59200: Pillow Python Library DOS Vulnerability

CVE-2026-59200 Overview

CVE-2026-59200 is a resource exhaustion vulnerability in Pillow, the widely used Python imaging library. The flaw resides in PdfParser.PdfStream.decode() within PIL/PdfParser.py, where zlib.decompress() is invoked with a bufsize derived from the PDF stream Length field but without any bound on the decompressed output size. A crafted FlateDecode PDF stream can force Pillow to allocate excessive memory from a small input file, exhausting available memory on the host process. The issue affects Pillow versions from 5.1.0 up to but not including 12.3.0 and is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A remote attacker can trigger memory exhaustion and denial of service by delivering a small, crafted PDF file to any application that parses PDFs with Pillow.

Affected Products

Pillow versions 5.1.0 through 12.2.x
Python applications using PIL.PdfParser to parse untrusted PDF files
Downstream libraries and services embedding vulnerable Pillow releases

Discovery Timeline

2026-07-14 - CVE-2026-59200 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59200

Vulnerability Analysis

The vulnerability originates in Pillow's PDF stream decoding logic. When Pillow parses a PDF containing a FlateDecode filter, PdfParser.PdfStream.decode() calls zlib.decompress(data, bufsize=length), using the PDF stream's declared Length field as the initial buffer size hint. The Length field describes the compressed input size, not the decompressed output size. Because zlib performs no absolute cap on output growth, a highly compressible payload can expand by several orders of magnitude during decompression.

An attacker constructs a PDF whose FlateDecode stream contains a small compressed blob that decompresses into gigabytes of data. When Pillow parses the file, the Python process attempts to allocate memory for the full decompressed output and is either killed by the operating system's out-of-memory handler or degrades the host with heavy swapping.

Root Cause

The root cause is missing output-size enforcement during decompression. PdfParser.PdfStream.decode() trusted attacker-controlled length metadata to size the buffer and did not impose an upper bound on decompressed output. The fix in pull request #9718 introduces a max_length parameter to the decode path, delegating bounded decompression to ImageFile and rejecting streams that exceed the configured limit.

Attack Vector

Exploitation requires only that a vulnerable application parse an attacker-supplied PDF with Pillow. No authentication or user interaction beyond file processing is required. Common exposure points include document upload endpoints, image thumbnailing services, content management systems, and automated document pipelines that convert or preview PDF files.

python

 import zlib
 from typing import Any, NamedTuple
 
+from . import ImageFile
+
 TYPE_CHECKING = False
 if TYPE_CHECKING:
     from typing import IO

Source: Pillow commit f7a31ea — This patch imports ImageFile into PdfParser.py so that PdfStream.decode() can enforce a bounded max_length during zlib decompression, preventing unbounded memory allocation.

Detection Methods for CVE-2026-59200

Indicators of Compromise

Python worker processes terminated by the Linux OOM killer while parsing PDF uploads
Sudden spikes in resident memory tied to processes importing PIL.PdfParser
Small PDF files (a few kilobytes) causing sustained high memory allocation during processing
Repeated crash or restart events in image-processing services immediately after receiving a PDF

Detection Strategies

Inventory Python environments and identify installations of Pillow prior to 12.3.0 using pip list or SBOM data.
Instrument PDF-handling services with per-request memory ceilings and log allocations that exceed baseline thresholds.
Inspect ingested PDFs for FlateDecode streams with a large declared /Length mismatch relative to file size.

Monitoring Recommendations

Alert on repeated OOM kills for processes linked to Pillow or PDF ingestion workers.
Monitor upload endpoints for anomalous PDF submissions followed by service restarts.
Track Pillow package versions across build pipelines and container images to catch drift from patched releases.

How to Mitigate CVE-2026-59200

Immediate Actions Required

Upgrade Pillow to version 12.3.0 or later across all production, staging, and build environments.
Rebuild and redeploy container images that pin an older Pillow release.
Audit dependent packages that transitively require Pillow and pin them to versions compatible with 12.3.0.

Patch Information

The vulnerability is fixed in Pillow 12.3.0. The upstream fix is tracked in GitHub Pull Request #9718 and merged in commit f7a31ea. See the Pillow 12.3.0 release notes and the GHSA-jjj6-mw9f-p565 advisory for details.

Workarounds

Reject PDF uploads at the application boundary if PDF parsing with Pillow is not required.
Run PDF-processing workers under strict memory limits using cgroups, Kubernetes resources.limits.memory, or systemd MemoryMax.
Validate incoming PDF file sizes and reject files whose declared stream Length values are inconsistent with the file size.

bash

# Upgrade Pillow to the patched release
pip install --upgrade 'Pillow>=12.3.0'

# Verify the installed version
python -c "import PIL; print(PIL.__version__)"

# Example Kubernetes memory limit for a PDF-processing worker
# resources:
#   limits:
#     memory: "512Mi"