CVE-2026-54058
criticalPillow is a Python imaging library.
Vendor / product: Python — pillow
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-14 17:17
Modified: 2026-10-24 21:10
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / pillow <12.3.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d
Patch / mitigation: https://github.com/python-pillow/Pillow/pull/9719
Patch / mitigation: https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
Patch / mitigation: https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
References
- https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d security-advisories@github.com
- https://github.com/python-pillow/Pillow/pull/9719 security-advisories@github.com
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0 security-advisories@github.com
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93 security-advisories@github.com
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗