VDB
CVE-2026-59198
CVE-2026-59198
PUBLISHED
CVSS 6.5 MEDIUM
Reported by GitHub_M · Published July 14, 2026
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 5.2.0, < 12.3.0 |
| chainguard | superset-6.1 | 0, 0, 0 |
| chainguard | text-generation-inference | 0, 0 |
| chainguard | label-studio | 0, 0, 0 |
| chainguard | openstack-horizon-2025.2-fips | 0, 0, 0 |
| wolfi | superset-6.1 | 0, 0, 0 |
| PyPI | Pillow | 5.2.0 |
| chainguard | lmcache-cuda-12.8 | 0 |
| chainguard | openstack-horizon-2026.1 | 0, 0, 0 |
| python-pillow | Pillow | >= 5.2.0, < 12.3.0, >= 5.2.0, < 12.3.0 |
| chainguard | superset-fips-6.1 | 0 |
| wolfi | mlflow | 0, 0, 0 |
| chainguard | open-webui | 0, 0, 0 |
| chainguard | tritonserver-backend-vllm-cuda-13.0 | 0, 0 |
| chainguard | tensorflow-gpu-jupyter | 0, 0 |
| chainguard | mlflow | 0, 0, 0 |
| chainguard | openstack-horizon-2026.1-fips | 0, 0, 0 |
| wolfi | superset-6.0 | 0, 0, 0 |
| wolfi | open-webui | 0, 0 |
| chainguard | openstack-horizon-2025.2 | 0, 0, 0 |
…and 1 more
Timeline
- Jul 14, 2026 CVE Published
- Jul 15, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
- Aug 7, 2026 Security Advisory
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/pull/9709 x_refsource_MISC
- https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-59198 advisory
- https://github.com/advisories/GHSA-fj7v-r99m-22gq advisory