CVE-2026-59198

EUVD-2026-43752
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
pythonpillow
5.2.0 ≤
𝑥
< 12.3.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
https://github.com/python-pillow/Pillow/pull/9709
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq