CVE-2026-59198: python-pillow pillow Out-of-bounds Read
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-fj7v-r99m-22gqBIT-pillow-2026-59198PYSEC-2026-3494UBUNTU-CVE-2026-59198USN-8690-1DEBIAN-CVE-2026-59198CGA-3c5r-223h-prwxCGA-4f5x-8g6h-6rcrCGA-63rm-v8g6-m6cmCGA-86j6-jrg3-gw7xCGA-c46v-ffrw-hwfxCGA-fxm5-32cg-4fxmCGA-gghj-mv5q-cch5CGA-h9q9-wv62-3rrjCGA-m6h9-hmrx-6g2cCGA-mrj6-p287-jcfgCGA-pf7j-j6h9-m3c2CGA-wg5x-p3fx-q93hCGA-x4j7-px94-hc3rCGA-xf9f-53h6-q9f7CGA-xq33-vjhj-4vw7CGA-4p6x-w38p-mjjgCGA-4wmc-42qq-vwwhCGA-69v3-5wp6-48x9CGA-9fwp-qwcf-74hmCGA-9qr7-9gpf-r5m4CGA-9vf4-4rwf-639mCGA-c29v-3jwg-63mhCGA-c4xr-mx4v-g526CGA-gc8c-ccx3-78qhCGA-h59p-853r-r44xCGA-hxfw-vvr7-3fr9CGA-m5j4-xjgw-c6fgCGA-m5jv-5xrw-gxgmCGA-m684-2fr9-p23mCGA-pvwm-c39w-49rqCGA-q4hm-rppg-pmrv
Published 14-07-2026Last modified 14-07-2026
Vulnerability summary
CVE-2026-59198 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in python-pillow pillow. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.31%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources7 sources · 6.5–7.5
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:LDiffers
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:LDiffers
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
-0.01 pp
From 0.33% on 19-09-2026
19-09-202619-10-2026
EPSS score0.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPillow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard15 products
- label-studio< 1.23.0-r11
- lmcache-cuda-12.8< 0.5.3-r0
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.11.0-r0 | < 0.10.2-r1 | All versions (No fix recorded)
- openstack-horizon-2025.2< 25.5.2_git20260617-r4
Wolfi5 products
- mlflow< 3.14.0-r2 | < 3.16.0-r0
- open-webui< 0.11.0-r0 | < 0.10.2-r1 | All versions (No fix recorded)
- superset-6.0< 6.0.0-r13
- superset-6.1< 6.1.0-r6
- superset-6.1-iamguarded-compatAll versions (No fix recorded)
Ubuntu2 products
- pillow< 7.0.0-4ubuntu0.9+esm1 | < 9.0.1-1ubuntu0.5 | < 10.2.0-1ubuntu1.3 | < 12.1.1-2ubuntu1.3
- pillow-python2All versions (No fix recorded)
Debian1 product
- pillowAll versions (No fix recorded) | < 12.3.0-1
PyPI1 product
- pillow≥ 5.2.0, < 12.3.0
Python1 product
- pillow≥ 5.2.0, < 12.3.0
Python-pillow1 product
- pillow≥ 5.2.0, < 12.3.0
7 vendors · 26 products
References
13 links- github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gqX Refsource CONFIRMWEBREPORTAdvisoryExploitVendor Advisory
- github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4bX Refsource MISCWEBREPORTFIXPatch
- pypi.org/project/pillowPACKAGE
