Tetrak
GitHub ↗
Security · Pillow

Coordinates near the 32-bit limit write out of bounds in Pillow's paste and crop

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Advisory
CVE-2026-59199
Library
Pillow, pillow on PyPI
Published
Severity
7.5 out of 10, as published
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Image.paste or Image.crop with coordinates the program supplies near the signed 32-bit limits.

What sillybos does

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

The trigger is the box the program passes to paste, crop or alpha_composite, with a coordinate within a few pixels of the signed 32-bit limit; the opened file only scales the write, by its width. No header shows what a program will later pass. What the check does is bound the geometry: with max_side at 30,000 by default, a box a program derives from the image's own size, as Tetrak OCR's tile crops are, stays five orders of magnitude below the wrap point. A box taken from anywhere else, a request or a file's metadata, is out of its reach, and the program must clip it to the image itself.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03: what the file contributes, and what the check bounds.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Derive boxes from the image's size, which the check bounds, and clip any box that comes from outside to the image before passing it to Pillow; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources