High [CVE-2026-59199] Denial of Service via out-of-bounds write in image processing

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite().

This issue is fixed in version 12.3.0. A remote attacker could exploit a vulnerability in the library's image processing functions, specifically when handling image coordinates near certain limits.

This flaw, a native heap out-of-bounds write, could lead to a denial of service (DoS), making the affected system or application unavailable. While the underlying issue is a heap out-of-bounds write, it does not provide a controlled write primitive exploitable for code execution in affected Red Hat products.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-190.

Affected Red Hat products: Red Hat AI Inference Server 3.3; Red Hat OpenShift AI 3.4; Red Hat Quay 3.1; Red Hat Quay 3.12; Red Hat Quay 3.15; Red Hat Quay 3.9; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.

Under investigation: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Satellite 6.