---
schema_version: '1.0'
id: security-20260716-a3f93e
url: https://osv.dev/vulnerability/PYSEC-2026-3452
url_hash: a3f93eb758633c9d44d1f144ef2067de5270e3d819b2662e6c6c85dd17517322
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-3452
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-59203
- PYSEC-2026-3452
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-07-14T16:17:02Z'
fetched_at: '2026-07-16T06:46:04Z'
updated_at: '2026-07-16T06:46:07Z'
status: published
content_hash: 300c1361a6763dc7675383709e554a8fb07e1baec32191ba797bb7ec01295599
license_note: full
summary: Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's
  EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary
  directive, allowing a crafted EPS file to cause Image.open() to seek backwards to
  the same directive and parse it repeat
summary_source: rss
summary_en: Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's
  EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary
  directive, allowing a crafted EPS file to cause Image.open() to seek backwards to
  the same directive and parse it repeat
entities:
- name: Pillow
  type: artifact
key_facts: []
related: []
related_auto: []
title: CVE-2026-59203 — pillow
---

# CVE-2026-59203 — pillow

## TL;DR
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeat

## Key Points
- cve / CVE-2026-59203 / PYSEC-2026-3452 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-3452 (CVE-2026-59203)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.3.0 [docker/docker-llmwiki]
- `PyPI:pillow` 12.2.0 → fixed in 12.3.0 [docker/local+docker/mac]

**Details:**
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.

**References:**
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0
- https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
- https://github.com/python-pillow/Pillow/pull/9708
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-3452_

## Source
元記事: [CVE-2026-59203 — pillow](https://osv.dev/vulnerability/PYSEC-2026-3452) — published 2026-07-14T16:17:02Z