Infinite loop in Pillow - CVE-2026-59203

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the EPS parser in PIL/EpsImagePlugin.py when parsing a crafted EPS %%BeginBinary directive during Image.open(). A remote attacker can supply a specially crafted EPS file with a negative byte count to cause a denial of service.

The issue is triggered during Image.open(), does not require calling Image.load(), and does not require Ghostscript execution.

Affected software

How to mitigate CVE-2026-59203

External References

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

Related Security Bulletins

• Multiple vulnerabilities in Pillow
• Anolis OS update for python-pillow