--- id: CVE-2026-54058 title: >- Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image (CVE-2026-54058) summary: >- A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel a… severity: critical cvss: 9.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H' cvssSource: vendor cwe: CWE-125 vendor: Red Hat product: Red Hat OpenShift AI 3.4 affected: - exploit_intelligence - lightspeed_core - openshift_lightspeed - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_eus_extension_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_crb_v_8 - ai_inference_server 3.3 - ai_inference_server 3.4 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - enterprise_linux_ai 3.3 - openshift_ai 3.4 - quay 3.10 - quay 3.12 - quay 3.14 - quay 3.15 - quay 3.16 - quay 3.9 patched: - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_eus_extension_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_crb_v_8 - ai_inference_server 3.3 - ai_inference_server 3.4 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - enterprise_linux_ai 3.3 - openshift_ai 3.4 - quay 3.10 - quay 3.12 - quay 3.14 - quay 3.15 - quay 3.16 - quay 3.9 published: '2026-07-14' updated: '2026-09-24' sourceUpdated: '2026-09-24T05:55:53+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json - url: 'https://access.redhat.com/security/cve/CVE-2026-54058' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2500057' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54058' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54058' - url: >- https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d - url: 'https://github.com/python-pillow/Pillow/pull/9719' - url: 'https://github.com/python-pillow/Pillow/releases/tag/12.3.0' - url: >- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93 - url: 'https://access.redhat.com/errata/RHSA-2026:48021' - url: 'https://access.redhat.com/errata/RHSA-2026:52551' - url: 'https://access.redhat.com/errata/RHSA-2026:54528' - url: 'https://access.redhat.com/errata/RHSA-2026:54417' - url: 'https://access.redhat.com/errata/RHSA-2026:59518' - url: 'https://access.redhat.com/errata/RHSA-2026:70996' - url: 'https://access.redhat.com/errata/RHSA-2026:69468' - url: 'https://access.redhat.com/errata/RHSA-2026:69466' - url: 'https://access.redhat.com/errata/RHSA-2026:70965' - url: 'https://access.redhat.com/errata/RHSA-2026:70979' - url: 'https://access.redhat.com/errata/RHSA-2026:69467' - url: 'https://access.redhat.com/errata/RHSA-2026:70995' - url: 'https://access.redhat.com/errata/RHSA-2026:69469' - url: 'https://access.redhat.com/errata/RHSA-2026:70969' - url: 'https://access.redhat.com/errata/RHSA-2026:69464' - url: 'https://access.redhat.com/errata/RHSA-2026:50479' - url: 'https://access.redhat.com/errata/RHSA-2026:50340' - url: 'https://access.redhat.com/errata/RHSA-2026:62336' - url: 'https://access.redhat.com/errata/RHSA-2026:62335' - url: 'https://access.redhat.com/errata/RHSA-2026:60520' - url: 'https://access.redhat.com/errata/RHSA-2026:53520' - url: 'https://access.redhat.com/errata/RHSA-2026:52968' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' - url: 'https://access.redhat.com/errata/RHSA-2026:48933' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:50931' - url: 'https://github.com/python-pillow/Pillow' - url: 'https://github.com/advisories/GHSA-62p4-gmf7-7g93' tags: - csaf - vex - red-hat - osv - pip - ghsa epss: 0.0068 epssPercentile: 0.50261 aliases: - GHSA-62p4-gmf7-7g93 - BIT-pillow-2026-54058 - PYSEC-2026-3493 ecosystem: pip ingestedAt: '2026-07-20T21:43:15.679Z' --- ## Overview A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault. ## Vendor advisories - **RHSA-2026:48021** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48021) - **RHSA-2026:52551** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52551) - **RHSA-2026:54528** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54528) - **RHSA-2026:54417** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54417) - **RHSA-2026:59518** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59518) - **RHSA-2026:70996** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70996) - **RHSA-2026:69468** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69468) - **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466) - **RHSA-2026:70965** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70965) - **RHSA-2026:70979** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70979) - **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Exploit Intelligence, Lightspeed Core, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54058.json) - **RHSA-2026:69469** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69469) - **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464) - **RHSA-2026:50479** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50479) - **RHSA-2026:50340** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50340) - **RHSA-2026:62336** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62336) - **RHSA-2026:62335** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62335) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) - **RHSA-2026:53520** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53520) **Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image** — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-24. Affected: - Exploit Intelligence - Lightspeed Core - OpenShift Lightspeed - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream AUS (v.8.4) - Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) - Red Hat Enterprise Linux AppStream AUS (v.8.6) - Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) - Red Hat Enterprise Linux AppStream E4S (v.8.8) - Red Hat Enterprise Linux AppStream TUS (v.8.8) - Red Hat Enterprise Linux CRB (v. 8) - Red Hat AI Inference Server 3.3 - Red Hat AI Inference Server 3.4 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Enterprise Linux AI 3.3 - Red Hat OpenShift AI 3.4 - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.14 - Red Hat Quay 3.15 - Red Hat Quay 3.16 - Red Hat Quay 3.9 No fix planned: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Exploit Intelligence - Lightspeed Core - OpenShift Lightspeed - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Not affected: - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Enterprise Linux AI 3.3 - Red Hat OpenShift AI 3.4 - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.14 - Red Hat Quay 3.15 - Red Hat Quay 3.16 - Red Hat Quay 3.9 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48021 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:52551 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54528 ## Package advisory (CVE-2026-54058) Affected packages: - `pillow < 12.3.0` Patched in: - `pillow 12.3.0` Source: https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93