A tiled JPEG 2000 grows Pillow's scratch buffer to a whole image

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Advisory

CVE-2026-59204

Library

Pillow, pillow on PyPI

Published

2026-07-20

Severity

not scored upstream

Affected

< 12.3.0

Fixed in

12.3.0

Reaches you

by opening a file

What triggers it

Image.open and load on a crafted tiled JPEG 2000 file with many small tiles.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

A JPEG 2000 file is refused by name before Pillow sees it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_format_a_scan_never_is

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Refuse JPEG 2000 by name, as sillybos does by default.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-vjc4-5qp5-m44j
• https://osv.dev/vulnerability/PYSEC-2026-3496
• The record entry, triaged 2026-11-03, last checked 2026-11-03