CVE-2026-59197High· 8.2▾ Twilight

Pillow: Pillow: Native heap out-of-bounds write (CVE-2026-59197)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 45.1 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 14, 2026

Updated

Oct 15, 2026

CVSS

8.2

Vendor

Red Hat

Product

Red Hat OpenShift AI 3.4

CWE

CWE-787, CWE-190

Depth score

45 · Moderate

EPSS

0.45% · p39

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 29.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 93 days

Jul 14, 2026Published
Disclosed via CSAF
Jul 29, 2026EPSS first tracked
0.4%
Sep 25, 2026EPSS peak
0.4% → 0.6%
Oct 15, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-787 CWE-190 #csaf #vex #red-hat #osv #pip #ghsa

Affected

Patched in

ansible_automation_platform_2_5_for_rhel 8
satellite_6_16_for_rhel 8
ansible_automation_platform_2_5_for_rhel 9
ansible_automation_platform_2_6_for_rhel 9
satellite_6_16_for_rhel 9
enterprise_linux_appstream_v_8
enterprise_linux_appstream_aus_v_8_4
enterprise_linux_appstream_eus_extension_v_8_4
enterprise_linux_appstream_aus_v_8_6
enterprise_linux_appstream_eus_extension_v_8_6
enterprise_linux_appstream_e4s_v_8_8
enterprise_linux_appstream_tus_v_8_8
enterprise_linux_crb_v_8
ai_inference_server 3.4
ansible_automation_platform 2.6
ansible_automation_platform 2.7
enterprise_linux_ai 3.4
openshift_ai 3.3
openshift_ai 3.4
quay 3.10
quay 3.12
quay 3.14
quay 3.15
quay 3.16
quay 3.17
quay 3.18
quay 3.9

Full technical detail▾

Overview

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation, and ImagingExpand() computes output dimensions with unchecked signed integer arithmetic. This can lead to denial of service and limited integrity impact via heap corruption.

Vendor advisories

RHSA-2026:50319 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:50223 · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:50336 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:48021 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-07-29 · advisory
RHSA-2026:52551 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-08-10 · advisory
RHSA-2026:54528 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-13 · advisory
RHSA-2026:54417 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-12 · advisory
RHSA-2026:70996 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · advisory
RHSA-2026:69468 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · advisory
RHSA-2026:69466 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · advisory
RHSA-2026:70965 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · advisory
Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, Lightspeed Core, … · updated 2026-10-15 · vex
RHSA-2026:69467 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · advisory
RHSA-2026:69469 · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · advisory
RHSA-2026:50479 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · advisory
RHSA-2026:50340 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · advisory
RHSA-2026:60520 · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · advisory
RHSA-2026:53520 · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · advisory

Pillow: Pillow: Native heap out-of-bounds write — rated Important by Red Hat. Released 2026-07-14, updated 2026-10-15.

Affected:

Exploit Intelligence
Lightspeed Core
OpenShift Lightspeed
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
Red Hat Satellite 6

Fixed:

Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Satellite 6.16 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Satellite 6.16 for RHEL 9
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream AUS (v.8.4)
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
Red Hat Enterprise Linux AppStream AUS (v.8.6)
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
Red Hat Enterprise Linux AppStream E4S (v.8.8)
Red Hat Enterprise Linux AppStream TUS (v.8.8)
Red Hat Enterprise Linux CRB (v. 8)
Red Hat AI Inference Server 3.4
Red Hat Ansible Automation Platform 2.6
Red Hat Ansible Automation Platform 2.7
Red Hat Enterprise Linux AI 3.4
Red Hat OpenShift AI 3.3
Red Hat OpenShift AI 3.4
Red Hat Quay 3.10
Red Hat Quay 3.12
Red Hat Quay 3.14
Red Hat Quay 3.15
Red Hat Quay 3.16
Red Hat Quay 3.17
Red Hat Quay 3.18
Red Hat Quay 3.9

No fix planned:

Red Hat AI Inference Server
Red Hat Enterprise Linux AI (RHEL AI) 3
Exploit Intelligence
Lightspeed Core
OpenShift Lightspeed
Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)
Red Hat Satellite 6

Not affected:

Red Hat Ansible Automation Platform 2.6 for RHEL 10
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Satellite 6.16 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Satellite 6.16 for RHEL 9
Red Hat Ansible Automation Platform 2.6
Red Hat Ansible Automation Platform 2.7
Red Hat OpenShift AI 3.3
Red Hat OpenShift AI 3.4

Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319 Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:50223 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336

Package advisory (CVE-2026-59197)

Affected packages:

pillow < 12.3.0

Patched in:

pillow 12.3.0

Source: https://osv.dev/vulnerability/GHSA-xj96-63gp-2gmr

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip#ghsa

← Back to feed