{"id":"CVE-2026-54058","title":"Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image (CVE-2026-54058)","summary":"A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel a…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["exploit_intelligence","lightspeed_core","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","satellite 6","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_eus_extension_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_crb_v_8","ai_inference_server 3.3","ai_inference_server 3.4","ansible_automation_platform 2.6","ansible_automation_platform 2.7","enterprise_linux_ai 3.3","openshift_ai 3.4","quay 3.10","quay 3.12","quay 3.15","quay 3.16","quay 3.9"],"patched":["enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_eus_extension_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_eus_extension_v_8_6","enterprise_linux_appstream_e4s_v_8_8","enterprise_linux_appstream_tus_v_8_8","enterprise_linux_crb_v_8","ai_inference_server 3.3","ai_inference_server 3.4","ansible_automation_platform 2.6","ansible_automation_platform 2.7","enterprise_linux_ai 3.3","openshift_ai 3.4","quay 3.10","quay 3.12","quay 3.15","quay 3.16","quay 3.9"],"published":"2026-07-14","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:39:00+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-54058"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500057"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54058"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"},{"url":"https://github.com/python-pillow/Pillow/pull/9719"},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"},{"url":"https://access.redhat.com/errata/RHSA-2026:48021"},{"url":"https://access.redhat.com/errata/RHSA-2026:52551"},{"url":"https://access.redhat.com/errata/RHSA-2026:54528"},{"url":"https://access.redhat.com/errata/RHSA-2026:54417"},{"url":"https://access.redhat.com/errata/RHSA-2026:59518"},{"url":"https://access.redhat.com/errata/RHSA-2026:69468"},{"url":"https://access.redhat.com/errata/RHSA-2026:69466"},{"url":"https://access.redhat.com/errata/RHSA-2026:69467"},{"url":"https://access.redhat.com/errata/RHSA-2026:69469"},{"url":"https://access.redhat.com/errata/RHSA-2026:69464"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340"},{"url":"https://access.redhat.com/errata/RHSA-2026:62336"},{"url":"https://access.redhat.com/errata/RHSA-2026:62335"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:53520"},{"url":"https://access.redhat.com/errata/RHSA-2026:52968"},{"url":"https://access.redhat.com/errata/RHSA-2026:48933"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:50931"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://github.com/advisories/GHSA-62p4-gmf7-7g93"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00521,"epssPercentile":0.43056,"aliases":["GHSA-62p4-gmf7-7g93","BIT-pillow-2026-54058","PYSEC-2026-3493"],"ecosystem":"pip","ingestedAt":"2026-07-20T21:43:15.679Z","slug":"CVE-2026-54058","body":"## Overview\n\nA flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.\n\n## Vendor advisories\n\n- **RHSA-2026:48021** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48021)\n- **RHSA-2026:52551** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52551)\n- **RHSA-2026:54528** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54528)\n- **RHSA-2026:54417** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54417)\n- **RHSA-2026:59518** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59518)\n- **RHSA-2026:69468** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69468)\n- **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466)\n- **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467)\n- **RHSA-2026:69469** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69469)\n- **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464)\n- **RHSA-2026:50479** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50479)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Exploit Intelligence, Lightspeed Core, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json)\n- **RHSA-2026:50340** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50340)\n- **RHSA-2026:62336** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62336)\n- **RHSA-2026:62335** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62335)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:53520** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53520)\n\n**Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image** — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-21.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.8)\n- Red Hat Enterprise Linux AppStream TUS (v.8.8)\n- Red Hat Enterprise Linux CRB (v. 8)\n- Red Hat AI Inference Server 3.3\n- Red Hat AI Inference Server 3.4\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat OpenShift AI 3.4\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n- Red Hat Quay 3.15\n- Red Hat Quay 3.16\n- Red Hat Quay 3.9\n\nNo fix planned:\n\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat OpenShift AI 3.4\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n- Red Hat Quay 3.15\n- Red Hat Quay 3.16\n- Red Hat Quay 3.9\n- OpenShift Lightspeed\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48021\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:52551\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54528\n\n## Package advisory (CVE-2026-54058)\n\nAffected packages:\n\n- `pillow < 12.3.0`\n\nPatched in:\n\n- `pillow 12.3.0`\n\nSource: https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208483,"id":"CVE-2026-54058","ts":1790005716865,"field":"severity","old":"high","new":"critical"},{"seq":201764,"id":"CVE-2026-54058","ts":1789399675532,"field":"cvss","old":null,"new":"9.1"},{"seq":200494,"id":"CVE-2026-54058","ts":1789397340694,"field":"cvss","old":"9.1","new":null},{"seq":198411,"id":"CVE-2026-54058","ts":1789391902109,"field":"cvss","old":null,"new":"9.1"},{"seq":196204,"id":"CVE-2026-54058","ts":1789383547785,"field":"cvss","old":"9.1","new":null},{"seq":195133,"id":"CVE-2026-54058","ts":1789380425297,"field":"cvss","old":null,"new":"9.1"},{"seq":193920,"id":"CVE-2026-54058","ts":1789378442700,"field":"cvss","old":"9.1","new":null},{"seq":192707,"id":"CVE-2026-54058","ts":1789376375284,"field":"cvss","old":null,"new":"9.1"},{"seq":191494,"id":"CVE-2026-54058","ts":1789373352642,"field":"cvss","old":"9.1","new":null},{"seq":190279,"id":"CVE-2026-54058","ts":1789369260019,"field":"cvss","old":null,"new":"9.1"},{"seq":189066,"id":"CVE-2026-54058","ts":1789368226832,"field":"cvss","old":"9.1","new":null},{"seq":187849,"id":"CVE-2026-54058","ts":1789365117779,"field":"cvss","old":null,"new":"9.1"},{"seq":186636,"id":"CVE-2026-54058","ts":1789363220412,"field":"cvss","old":"9.1","new":null},{"seq":185422,"id":"CVE-2026-54058","ts":1789361064990,"field":"cvss","old":null,"new":"9.1"},{"seq":184209,"id":"CVE-2026-54058","ts":1789358098867,"field":"cvss","old":"9.1","new":null},{"seq":182460,"id":"CVE-2026-54058","ts":1789354192792,"field":"cvss","old":null,"new":"9.1"},{"seq":181253,"id":"CVE-2026-54058","ts":1789353081150,"field":"cvss","old":"9.1","new":null},{"seq":180046,"id":"CVE-2026-54058","ts":1789350136436,"field":"cvss","old":null,"new":"9.1"},{"seq":178839,"id":"CVE-2026-54058","ts":1789348045242,"field":"cvss","old":"9.1","new":null},{"seq":177632,"id":"CVE-2026-54058","ts":1789346253758,"field":"cvss","old":null,"new":"9.1"},{"seq":176425,"id":"CVE-2026-54058","ts":1789342968249,"field":"cvss","old":"9.1","new":null},{"seq":174542,"id":"CVE-2026-54058","ts":1789334731686,"field":"cvss","old":null,"new":"9.1"},{"seq":173337,"id":"CVE-2026-54058","ts":1789333457526,"field":"cvss","old":"9.1","new":null},{"seq":172151,"id":"CVE-2026-54058","ts":1789330971807,"field":"cvss","old":null,"new":"9.1"},{"seq":170965,"id":"CVE-2026-54058","ts":1789328556571,"field":"cvss","old":"9.1","new":null},{"seq":169760,"id":"CVE-2026-54058","ts":1789327036517,"field":"cvss","old":null,"new":"9.1"},{"seq":168555,"id":"CVE-2026-54058","ts":1789323618077,"field":"cvss","old":"9.1","new":null},{"seq":167350,"id":"CVE-2026-54058","ts":1789319468363,"field":"cvss","old":null,"new":"9.1"},{"seq":166145,"id":"CVE-2026-54058","ts":1789318497813,"field":"cvss","old":"9.1","new":null},{"seq":164940,"id":"CVE-2026-54058","ts":1789315673301,"field":"cvss","old":null,"new":"9.1"},{"seq":163735,"id":"CVE-2026-54058","ts":1789313423663,"field":"cvss","old":"9.1","new":null},{"seq":162530,"id":"CVE-2026-54058","ts":1789311799219,"field":"cvss","old":null,"new":"9.1"},{"seq":161325,"id":"CVE-2026-54058","ts":1789308478780,"field":"cvss","old":"9.1","new":null},{"seq":160830,"id":"CVE-2026-54058","ts":1789304413440,"field":"cvss","old":null,"new":"9.1"},{"seq":160377,"id":"CVE-2026-54058","ts":1789303940624,"field":"cvss","old":"9.1","new":null},{"seq":159438,"id":"CVE-2026-54058","ts":1789300367932,"field":"cvss","old":null,"new":"9.1"},{"seq":158668,"id":"CVE-2026-54058","ts":1789299438119,"field":"cvss","old":"9.1","new":null},{"seq":157632,"id":"CVE-2026-54058","ts":1789296560122,"field":"cvss","old":null,"new":"9.1"},{"seq":156427,"id":"CVE-2026-54058","ts":1789294536677,"field":"cvss","old":"9.1","new":null},{"seq":155222,"id":"CVE-2026-54058","ts":1789292762258,"field":"cvss","old":null,"new":"9.1"},{"seq":154017,"id":"CVE-2026-54058","ts":1789289537324,"field":"cvss","old":"9.1","new":null},{"seq":152667,"id":"CVE-2026-54058","ts":1789281457749,"field":"cvss","old":null,"new":"9.1"},{"seq":152307,"id":"CVE-2026-54058","ts":1789281050656,"field":"cvss","old":"9.1","new":null},{"seq":151268,"id":"CVE-2026-54058","ts":1789277509538,"field":"cvss","old":null,"new":"9.1"},{"seq":150229,"id":"CVE-2026-54058","ts":1789276035345,"field":"cvss","old":"9.1","new":null},{"seq":149196,"id":"CVE-2026-54058","ts":1789273675280,"field":"cvss","old":null,"new":"9.1"},{"seq":148163,"id":"CVE-2026-54058","ts":1789271064223,"field":"cvss","old":"9.1","new":null},{"seq":146198,"id":"CVE-2026-54058","ts":1789269261250,"field":"cvss","old":null,"new":"9.1"},{"seq":142811,"id":"CVE-2026-54058","ts":1789261314342,"field":"cvss","old":"9.1","new":null},{"seq":141642,"id":"CVE-2026-54058","ts":1789258719879,"field":"cvss","old":null,"new":"9.1"}]}