Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Pillowの12.3.0未満に境界外読み取り。McIdas AREA画像をファイル名から開く経路限定ですが、成立するとプロセスメモリが漏れます。画像アップロードを受ける実装なら形式の絞り込みが緩和になります。修正版と、なぜ経路が限定的なのかをまとめました。 https://cve.autoarticles.net/cve/CVE-2026-54058
Post summary
The post reports that Pillow versions below 12.3.0 suffer an out-of-bounds read that can leak process memory and references the available fix and explanatory summary.
⚠️ Linux Exploit Intelligence alert: CVE-2026-54058 (CVSS 9.1) Remote attackers could disrupt service or cause a denial of service without user interaction. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-54058 #Linux #ExploitIntelligence #CyberSecurity #CVE
Post summary
CVE‑2026‑54058 is a high‑severity (CVSS 9.1) remote denial‑of‑service flaw; the advisory urges users to upgrade to vendor‑supplied fixes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | python | pillow | - | - | - |