CVE-2026-59198

Katalog CVE

CVSS 7.5 · High EPSS 0,31%

Kerentanan Out-of-bounds Read pada python pillow. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq exploit · advisory vendor
• https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b patch
• https://github.com/python-pillow/Pillow/pull/9709 issue tracking · patch
• https://github.com/python-pillow/Pillow/releases/tag/12.3.0 release notes