CVE-2026-59198
Fixed in a distro release EPSS <1%CVSS 6.5
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | label-studio | 1.23.0-r11 |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow | 3.14.0-r2 |
| Chainguard | open-webui | 0.10.2-r1 |
| Chainguard | open-webui | no fix |
| Chainguard | open-webui | 0.11.0-r0 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r4 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r5 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260630-r2 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260630-r2 |
| Chainguard | superset-6.0 | 6.0.0-r13 |
| Chainguard | superset-6.1 | 6.1.0-r6 |
| Chainguard | superset-6.1-iamguarded-compat | no fix |
| Chainguard | superset-fips-6.1 | 6.1.0-r5 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r7 |
| Chainguard | text-generation-inference | 3.3.7-r20 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r11 |
| Debian 12 | pillow | no fix |
| Debian 13 | pillow | no fix |
| Debian 14 | pillow | 12.3.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Pillow | 7.2.0-150300.3.30.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server 16.0 | python-Pillow | 11.3.0-160000.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-Pillow | 9.5.0-150400.5.25.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Pillow | 11.3.0-160000.8.1 |
| Ubuntu 22.04 LTS | pillow | 9.0.1-1ubuntu0.5 |
| Ubuntu 24.04 LTS | pillow | 10.2.0-1ubuntu1.3 |
| Ubuntu 26.04 LTS | pillow | 12.1.1-2ubuntu1.3 |
| Ubuntu Pro 20.04 LTS | pillow | 7.0.0-4ubuntu0.9+esm1 |
| Ubuntu Pro 20.04 LTS | pillow-python2 | no fix |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | mlflow | 3.14.0-r2 |
| Wolfi | open-webui | no fix |
| Wolfi | open-webui | 0.10.2-r1 |
| Wolfi | open-webui | 0.11.0-r0 |
| Wolfi | superset-6.0 | 6.0.0-r13 |
| Wolfi | superset-6.1 | 6.1.0-r6 |
| Wolfi | superset-6.1-iamguarded-compat | no fix |
| openSUSE Leap 16.0 | python-Pillow | 11.3.0-160000.8.1 |
| openSUSE Tumbleweed | python-Pillow | 12.3.0-2.1 |