High [CVE-2026-59204] Denial of Service via crafted JPEG2000 image

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding.

This issue is fixed in version 12.3.0. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file.

Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures. The impact is limited to denial of service via excessive memory allocation.

A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-131.

Affected products named by the advisory: Red Hat AI Inference Server 3.2; Red Hat AI Inference Server 3.3; Red Hat AI Inference Server 3.4; Red Hat Enterprise Linux AI 3.3; and 13 more.