What’s Vulnerable › Vulnerabilities

CVE-2026-54058: Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-125

Description

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Affected products

• python-pillow Pillow: before 12.3.0 — fixed in 12.3.0
• Pypi Pillow: before 12.3.0; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+100) — fixed in 12.3.0

How to fix

Upgrade to a fixed version: python-pillow Pillow 12.3.0; Pypi Pillow 12.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d
• https://github.com/python-pillow/Pillow/pull/9719
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93

Get alerted when CVE-2026-54058 or the next vulnerability affects your stack