Tetrak
GitHub ↗
Security · Pillow

An output image of the wrong mode corrupts the heap in ImageCms transforms

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Advisory
CVE-2026-59205
Library
Pillow, pillow on PyPI
Published
Severity
7.5 out of 10, as published
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

ImageCmsTransform.apply with an output image whose mode does not match the transform's.

What sillybos does

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

The mismatch is between two objects the program builds: a transform declared for one mode and an output image it allocates in another, passed together to apply. Nothing from a file sets either. The two routes a file's image takes into colour management both close it: profileToProfile builds the transform from the image's own mode and lets apply allocate the output in the transform's mode, and applyTransform refuses an image whose mode is not the transform's input mode before anything runs. An embedded profile from the file only builds the transform; it does not choose a mode. Checked against Pillow 13.0.0, whose C layer now refuses the mismatch outright. Neither Tetrak OCR nor sillybos imports ImageCms.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Validated on 2026-11-03 that a file's contents cannot cause the mismatch.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Let profileToProfile or applyTransform allocate the output image; never pass an output image of your own to apply; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources