CVE-2026-54058: python-pillow pillow Out-of-bounds Read
Vulnerability summary
CVE-2026-54058 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in python-pillow pillow. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 11 · Related 7Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPillow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard15 products
- label-studio< 1.23.0-r11
- lmcache-cuda-12.8< 0.5.3-r0
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.10.2-r1 | All versions (No fix recorded) | < 0.11.0-r0
- openstack-horizon-2025.2< 25.5.2_git20260617-r4
Wolfi5 products
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.10.2-r1 | All versions (No fix recorded) | < 0.11.0-r0
- superset-6.0< 6.0.0-r13
- superset-6.1< 6.1.0-r6
- superset-6.1-iamguarded-compatAll versions (No fix recorded)
Ubuntu2 products
- pillowAll versions (No fix recorded)
- pillow-python2All versions (No fix recorded)
Debian1 product
- pillowAll versions (No fix recorded) | < 12.3.0-1
Opensuse1 product
- python-graphifyy&distro=openSUSE Tumbleweed< 0.9.65-1.1
PyPI1 product
- pillow< 12.3.0
Python1 product
- pillow< 12.3.0
Python-pillow1 product
- pillow< 12.3.0
8 vendors · 27 products
References
13 links- github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93X Refsource CONFIRMWEBREPORTAdvisoryExploitMitigationVendor Advisory
- github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1dX Refsource MISCWEBFIXPatch
- pypi.org/project/pillowPACKAGE
