CVE-2026-59198

Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b	Patch
https://github.com/python-pillow/Pillow/pull/9709	Issue Tracking Patch
https://github.com/python-pillow/Pillow/releases/tag/12.3.0	Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq	Exploit Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pillow es una biblioteca de imágenes de Python. Desde 5.2.0 hasta 12.3.0, el codificador TGA RLE de Pillow lee más allá de su búfer de fila empaquetada al guardar una imagen en modo 1 con compresión TGA RLE, permitiendo que bytes adyacentes del heap del proceso sean copiados al archivo TGA generado. Este problema está solucionado en la versión 12.3.0.

Information

Published : 2026-07-14 16:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59198

Mitre link : CVE-2026-59198

CVE.ORG link : CVE-2026-59198

JSON object : View

Products Affected

python

pillow

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-59198", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59198", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T19:44:23.310384Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-pillow", "product": "Pillow", "versions": [{"status": "affected", "version": ">= 5.2.0, < 12.3.0"}]}]}], "published": "2026-07-14T16:17:01.797", "references": [{"url": "https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/pull/9709", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0."}, {"lang": "es", "value": "Pillow es una biblioteca de im\u00e1genes de Python. Desde 5.2.0 hasta 12.3.0, el codificador TGA RLE de Pillow lee m\u00e1s all\u00e1 de su b\u00fafer de fila empaquetada al guardar una imagen en modo 1 con compresi\u00f3n TGA RLE, permitiendo que bytes adyacentes del heap del proceso sean copiados al archivo TGA generado. Este problema est\u00e1 solucionado en la versi\u00f3n 12.3.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71FC37FA-5F2C-493F-B29E-6FEFAF36680F", "versionEndExcluding": "12.3.0", "versionStartIncluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}