CVE-2026-54058 python-pillow CVE debrief

Who should care

Developers and administrators using Pillow in their applications should be aware of this vulnerability and take steps to mitigate it. This includes updating Pillow to version 12.3.0 or later and restricting access to untrusted image sources. Security teams and vulnerability management teams should review the affected scope and severity of the vulnerability and plan for vendor-supported updates or mitigations.

Technical summary

The Pillow library, a Python imaging library, is vulnerable to a memory disclosure issue. When loading an uncompressed McIdas AREA image, attacker-controlled header words can set a row stride smaller than the natural row width. This can cause pixel access functions like Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. The issue is fixed in Pillow version 12.3.0. Affected product deployments should be reviewed for exposure and updated to the latest version.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 8.3 and the potential for memory disclosure.

Recommended defensive actions

• Update Pillow to version 12.3.0 or later
• Restrict access to untrusted image sources
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-54058 issue arises in Pillow, a Python imaging library, where loading an uncompressed McIdas AREA image can lead to memory disclosure due to attacker-controlled header words setting a row stride smaller than the natural row width. This can cause pixel access functions like Image.tobytes(), getpixel, convert, or save to read beyond the mapped region. The issue is fixed in Pillow version 12.3.0. Evidence is based on official CVE and NVD records, as well as vendor advisories from GitHub.

Official resources