Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-54058

Pillow is a Python imaging library

Risk score
88/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.5%
Published
14 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
Pillow library has a vulnerability in loading uncompressed McIdas AREA images, allowing attackers to disclose adjacent process memory. This can occur when using Image.tobytes(), getpixel, convert, or save functions.
Affected
{'product': 'pillow', 'package': None, 'version': 'prior to 12.3.0'}
Fix
Upgrade to version 12.3.0 or later
Exploitation
Public proof of concept

Story map

Story map: PillowTHE FLAWSTHE FIXCVE-2026-54058Pillow is a Python imaginglibraryCVSS 9.1 · EPSS 1%CVE-2026-112900Argument Injection inGhostscript call, potentiallyleading into RCECVSS 9.8 · EPSS 1%CVE-2026-112393Heap buffer overflow in_tiffWriteProc when savingTIFF to BytesIOCVSS 9.8 · EPSS 1%CVE-2026-112403Heap buffer overflow inImagingJpegDecodeCVSS 9.8 · EPSS 1%Upgrade Pillow12.3.0 · 13.0.0or later on your release lineWho is exposed{'products': ['Pillow'],'packages': ['Pillow'], 'versions':['>= 2.6.0, < 13.0.0']}RED · ACT TODAYPillowPillow has a vulnerability in itsGhostscript call, allowingargument injection, which couldlead to remote code execution.An attacker could injectGhostscript arguments bycontrolling the filename.Where it standsPublic proof of concept1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.23 Oct · The Hacker NewsCritical Flaw in Python’s Popular Pillow ImageLibrary Allows Code Execution via a Crafted Image4 Nov · Ubuntu security noticesUSN-8999-1: Pillow vulnerabilitiesCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)399 other warnings in 30 days →Same productEarlier Pillow warnings45 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pillow: Red, act today. Pillow has a vulnerability in its Ghostscript call, allowing argument injection, which could lead to remote code execution. An attacker could inject Ghostscript arguments by controlling the filename.

The flaws

  • CVE-2026-54058: Pillow is a Python imaging library (CVSS 9.1 · EPSS 1%)
  • CVE-2026-112900: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.8 · EPSS 1%)
  • CVE-2026-112393: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVSS 9.8 · EPSS 1%)
  • CVE-2026-112403: Heap buffer overflow in ImagingJpegDecode (CVSS 9.8 · EPSS 1%)

The fix

Upgrade Pillow: 12.3.0 · 13.0.0 or later on your release line

Who is exposed: {'products': ['Pillow'], 'packages': ['Pillow'], 'versions': ['>= 2.6.0, < 13.0.0']}

Where it stands

  • Public proof of concept
  • 1 outlet covering it

How it unfolded

  1. 23 Oct, The Hacker News (press): Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
  2. 4 Nov, Ubuntu security notices (official): USN-8999-1: Pillow vulnerabilities

Connects to

Why it is Red

  • CVSS 9.1 critical
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: python
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Last activity 4 Nov 2026. Patch Forecast updates every hour.