{"uuid": "09b1fe6d-25bd-4186-9068-8300edc8fea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59198", "type": "seen", "source": "https://gist.github.com/alon710/48f3deb1ca1eafb4018fbe6276da18c1", "content": "# CVE-2026-59198: CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59198\n\n## Summary\nCVE-2026-59198 is a high-severity heap out-of-bounds read vulnerability in Pillow, the Python imaging library, affecting versions from 5.2.0 up to 12.3.0. The vulnerability occurs in the TGA RLE compression path due to a calculation mismatch between the allocated packed 1-bit row buffer and the byte-level pixel stride assumption in the C-level encoder. This mismatch allows an attacker to leak up to approximately 57 KB of adjacent process heap memory directly into generated TGA image files.\n\n## TL;DR\nA calculation mismatch in Pillow's TGA RLE encoder allows remote attackers to leak up to 57 KB of process heap memory by saving 1-bit images with RLE compression.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: 0.00313\n- **Impact**: Information Disclosure (Heap Leak up to ~57 KB)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (Python Imaging Library)\n- **Pillow**: >= 5.2.0, < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to 12.3.0 or higher\n- Implement strict image mode validation before saving TGA outputs\n- Disable TGA RLE compression for untrusted user inputs\n\n**Remediation Steps:**\n1. Update requirements.txt or dependency configuration to use Pillow>=12.3.0\n2. Execute local test suites to verify that saving 1-bit (mode 1) TGA files with RLE compression raises an OSError exception\n3. Sandbox high-risk image-processing pipelines using isolated worker containers with limited privileges\n\n## References\n\n- [Pillow GitHub Security Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq)\n- [GitHub Pull Request #9709](https://github.com/python-pillow/Pillow/pull/9709)\n- [Official Patch Commit](https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b)\n- [Pillow v12.3.0 Release Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59198)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-59198)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59198) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T11:31:12.909840Z"}