CVE-2026-59204

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures.

The impact is limited to denial of service via excessive memory allocation. A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer.

For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene.