CVE-2026-54058
published 2026-07-14CVE-2026-54058: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path…
PriorityP352critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.52%
43.0th percentile
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Affected
79 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | >= 0 < 12.3.0 | 12.3.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
python-pillow Pillow up to 12.2.x AREA image tobytes stride information disclosure (Nessus ID 327748 / WID-SEC-2026-2592)
vuldb·2026-08-13·CVSS 9.1
CVE-2026-54058 [CRITICAL] python-pillow Pillow up to 12.2.x AREA image tobytes stride information disclosure (Nessus ID 327748 / WID-SEC-2026-2592)
A vulnerability, which was classified as problematic, has been found in python-pillow Pillow up to 12.2.x. Affected by this issue is the function tobytes of the component AREA image Handler. This manipulation of the argument stride causes information disclosure.
The identification of this vulnerability is CVE-2026-54058. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
ghsa·2026-07-20
CVE-2026-54058 [HIGH] CWE-125 Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
## Summary
When Pillow loads an uncompressed image whose tile uses the `raw` codec and a mode in `Image._MAPMODES`, and the image was opened **from a filename**, it memory-maps the file and builds the image's row pointers directly into the mapping via `PyImaging_MapBuffer` (`src/map.c`). The per-row spacing (`stride`) is taken from the tile arguments. `map.c` validates `offset + ysize*stride stride=1)
self.tile = [
ImageFile._Tile("raw", (0, 0) + self.size, offset, (rawmode, stride, 1))
]
```
**Step 2: `ImageFile.load` (mmap branch)** - selects mmap and delegates to `map_buffer`.
```python
# src/PIL/ImageFile.py:322-348
if use_mmap: # use_mmap = self.filename and len(self.tile) == 1
Red Hat
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
vendor_redhat·2026-07-14·CVSS 8.3
CVE-2026-54058 [HIGH] CWE-125 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixe
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [fedora-all]
bugzilla·2026-07-16·CVSS 8.3
CVE-2026-54058 [HIGH] CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [fedora-all]
CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [epel-all]
bugzilla·2026-07-16·CVSS 8.3
CVE-2026-54058 [HIGH] CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [epel-all]
CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
bugzilla·2026-07-14·CVSS 8.3
CVE-2026-54058 [HIGH] CVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
CVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1dhttps://github.com/python-pillow/Pillow/pull/9719https://github.com/python-pillow/Pillow/releases/tag/12.3.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
2026-07-14
Published