CVE-2026-59198

EUVD-2026-43752
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.77%
Affected Products (NVD)
VendorProductVersion
pythonpillow
5.2.0 ≤
𝑥
< 12.3.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pillow
bookworm
postponed
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
12.3.0-1
fixed
sid
12.3.0-1
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pillow
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
pillow-python2
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python311-Pillow
suse enterprise desktop 15 SP7
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP4
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP5
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP6
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP7
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP4
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP5
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP6
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP7
9.5.0-150400.5.25.1
fixed
python311-Pillow-tk
suse enterprise desktop 15 SP7
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP4
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP5
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP6
9.5.0-150400.5.25.1
fixed
suse enterprise sap 15 SP7
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP4
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP5
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP6
9.5.0-150400.5.25.1
fixed
suse enterprise server 15 SP7
9.5.0-150400.5.25.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-pillow-debuginfo
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python-pillow-debugsource
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python3-pillow
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python3-pillow-debuginfo
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python3-pillow-devel
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python3-pillow-tk
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
python3-pillow-tk-debuginfo
Amazon Linux 2023
0:9.4.0-2.amzn2023.0.10
fixed
Common Weakness Enumeration
References
https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
https://github.com/python-pillow/Pillow/pull/9709
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq