CVE-2026-54058: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header

unknownCVE-2026-54058

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-14
Last updated: 2026-07-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54058

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-540580.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54058	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Red Hat Enterprise Linux (Pillow): Multiple vulnerabilitiescert-bund

Recent advisories for Pillow is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] Red Hat Enterprise Linux (python-pillow): Multiple vulnerabilities allow denial of servicecert-bund · 2026-07-31
high[NEW] [high] Red Hat Enterprise Linux (Pillow): Multiple vulnerabilitiescert-bund · 2026-07-31
high[NEW] [high] Red Hat Satellite (foreman, python-pillow, go): Multiple vulnerabilitiescert-bund · 2026-07-30
highGHSA-9hw9-ch79-4vh6: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via out…ghsa · 2026-07-20
highGHSA-vjc4-5qp5-m44j: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial …ghsa · 2026-07-20
mediumGHSA-pg7v-jwj7-p798: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of se…ghsa · 2026-07-20