CVE-2026-54058

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d	Patch
https://github.com/python-pillow/Pillow/pull/9719	Issue Tracking Patch
https://github.com/python-pillow/Pillow/releases/tag/12.3.0	Product Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93	Exploit Mitigation Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pillow es una biblioteca de imágenes de Python. Antes de la versión 12.3.0, cuando Pillow carga una imagen McIdas AREA sin comprimir desde un nombre de archivo a través de la ruta del códec mmap raw, palabras de encabezado controladas por el atacante pueden establecer un paso de fila menor que el ancho de fila natural, causando que el acceso a píxeles, como Image.tobytes(), getpixel, convert o save, lea más allá de la región mapeada y divulgue memoria de proceso adyacente o cause un fallo. Este problema está solucionado en la versión 12.3.0.

Information

Published : 2026-07-14 17:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-54058

Mitre link : CVE-2026-54058

CVE.ORG link : CVE-2026-54058

JSON object : View

Products Affected

python

pillow

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-54058", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54058", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T17:53:55.907731Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-pillow", "product": "Pillow", "versions": [{"status": "affected", "version": "< 12.3.0"}]}]}], "published": "2026-07-14T17:17:03.433", "references": [{"url": "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/pull/9719", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0."}, {"lang": "es", "value": "Pillow es una biblioteca de im\u00e1genes de Python. Antes de la versi\u00f3n 12.3.0, cuando Pillow carga una imagen McIdas AREA sin comprimir desde un nombre de archivo a trav\u00e9s de la ruta del c\u00f3dec mmap raw, palabras de encabezado controladas por el atacante pueden establecer un paso de fila menor que el ancho de fila natural, causando que el acceso a p\u00edxeles, como Image.tobytes(), getpixel, convert o save, lea m\u00e1s all\u00e1 de la regi\u00f3n mapeada y divulgue memoria de proceso adyacente o cause un fallo. Este problema est\u00e1 solucionado en la versi\u00f3n 12.3.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6372231F-529B-45CD-978E-3F2AEFF5F95C", "versionEndExcluding": "12.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}