| Name | CVE-2026-54058 |
| Description | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| pillow (PTS) | bullseye | 8.1.2+dfsg-0.3+deb11u2 | vulnerable |
| bullseye (security) | 8.1.2+dfsg-0.3+deb11u3 | vulnerable | |
| bookworm, bookworm (security) | 9.4.0-1.1+deb12u1 | vulnerable | |
| trixie | 11.1.0-5+deb13u4 | vulnerable | |
| trixie (security) | 11.1.0-5+deb13u3 | vulnerable | |
| forky, sid | 12.2.0-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| pillow | source | (unstable) | (unfixed) |
https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
https://github.com/python-pillow/Pillow/pull/9719
Fixed by: https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d (12.3.0)