CVE-2026-54058
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Pillow before version 12.3.0 allows an attacker to read process memory or cause a fault when loading an uncompressed McIdas AREA image via the mmap codec path. Attacker-controlled header words can set a row stride smaller than the natural row width, leading to out-of-bounds read beyond the mapped region.
Risk Assessment
The risk involves potential disclosure of sensitive data from process memory or application crashes, which could lead to data loss or service disruption for the organization.
Recommendation
It is recommended to immediately upgrade Pillow to version 12.3.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.