PT-2026-58089 · Pypi · Pillow

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-59198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pillow versions 5.2.0 through 12.2.x

Description The TGA RLE encoder in the Pillow Python imaging library reads past its packed row buffer when saving a mode 1 image using TGA RLE compression. This behavior allows adjacent process heap bytes to be copied into the resulting TGA file.

Recommendations Update to version 12.3.0.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-59198

GHSA-FJ7V-R99M-22GQ

Affected Products

Pillow

References · 7

• 🔥 https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59198.json · Exploit
• https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b · Patch
• https://github.com/python-pillow/Pillow/pull/9709 · Patch
• https://osv.dev/vulnerability/CVE-2026-59198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59198 · Security Note
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 · Note