CVE-2026-59198
2 advisories.
PyPI/pillow CVE-2026-59198: medium 6.5, EPSS 0.31%
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Action: Upgrade pillow to 12.3.0 or later.
pip install pillow==12.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.2.0 | 12.3.0 | - |
Fixed versions
| 12.3.0 |
Sources
- osv: GHSA-fj7v-r99m-22gq
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq
- https://nvd.nist.gov/vuln/detail/CVE-2026-59198
- https://github.com/python-pillow/Pillow/pull/9709
- https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0
CVE-2026-59198 · published · modified · JSON
PyPI/pillow CVE-2026-59198: medium 6.5, EPSS 0.31%
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Action: Upgrade pillow to 12.3.0 or later.
pip install pillow==12.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.2.0 | 12.3.0 | - |
Fixed versions
| 12.3.0 |
Sources
- osv: PYSEC-2026-3494
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq
- https://nvd.nist.gov/vuln/detail/CVE-2026-59198
- https://github.com/python-pillow/Pillow/pull/9709
- https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0
- https://pypi.org/project/pillow
- https://github.com/advisories/GHSA-fj7v-r99m-22gq
CVE-2026-59198 · published · modified · JSON