Vulnerability Description
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Pillow | < 12.3.0 |
Related Weaknesses (CWE)
References
- https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90Patch
- https://github.com/python-pillow/Pillow/pull/9719Issue TrackingPatch
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0ProductRelease Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93ExploitMitigationVendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-54058?
CVE-2026-54058 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row...
How severe is CVE-2026-54058?
CVE-2026-54058 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-54058?
Check the references section above for vendor advisories and patch information. Affected products include: Python Pillow.