Bug 2500057 (CVE-2026-54058)

Summary:	CVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alinfoot, anpicker, anthomas, aprice, aruklets, bbrownin, cmyers, dfreiber, dnakabaa, doconnor, drow, dschmidt, dtrifiro, ebourniv, ehelms, ggainey, hasun, jburrell, jfula, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lcouzens, lgallett, mdellweg, mhulan, nmoumoul, nyancey, oezr, omaciel, ometelka, osousa, pcreech, ptisnovs, rbryant, rchan, rhel-process-autobot, sbunciak, simaishi, smallamp, stcannon, syedriko, teagle, tmalecek, ttakamiy, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes(), getpixel, convert, or save can then read beyond the mapped region, disclosing adjacent process memory or causing a fault.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2501496, 2501495
Bug Blocks:

Description OSIDB Bzimport 2026-07-14 17:02:57 UTC

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Comment 3 errata-xmlrpc 2026-07-29 21:03:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:48021 https://access.redhat.com/errata/RHSA-2026:48021

Comment 4 errata-xmlrpc 2026-08-10 03:58:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:52551 https://access.redhat.com/errata/RHSA-2026:52551

Comment 5 errata-xmlrpc 2026-08-12 18:17:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:54417 https://access.redhat.com/errata/RHSA-2026:54417

Comment 6 errata-xmlrpc 2026-08-13 11:08:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:54528 https://access.redhat.com/errata/RHSA-2026:54528