CVE-2026-59200 is a high-severity vulnerability in the Pillow library affecting versions from 5.1.0 up to but not including 12.3.0. The vulnerability arises because the PdfParser.PdfStream.decode() method calls zlib.decompress() with a buffer size derived directly from the PDF stream Length field, without bounding the decompressed output size. This lack of bounding allows an attacker to craft a FlateDecode PDF stream that causes excessive memory consumption, potentially leading to denial of service due to resource exhaustion. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The issue has been fixed in Pillow version 12.3.0.

An attacker can exploit this vulnerability by supplying a specially crafted PDF file with a FlateDecode stream that triggers excessive memory allocation during decompression. This can exhaust system memory, leading to denial of service conditions. There is no impact on confidentiality or integrity reported, only availability is affected.

A fix is available in Pillow version 12.3.0. Users should upgrade to version 12.3.0 or later to remediate this vulnerability. Since this is a library vulnerability, updating the Pillow dependency in affected applications is the recommended remediation. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes.