High [CVE-2026-59204] Denial of Service via crafted JPEG2000 image

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding.

This issue is fixed in version 12.3.0. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file.

Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures. The impact is limited to denial of service via excessive memory allocation.

A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-131. Affected Red Hat products: Red Hat AI Inference Server 3.3; Red Hat OpenShift AI 3.4; Red Hat Quay 3.1; Red Hat Quay 3.12; Red Hat Quay 3.15; Red Hat Quay 3.9; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.