Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b Patch
- https://github.com/python-pillow/Pillow/pull/9709 Issue Tracking, Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · pythonNVD modified 2026-10-24 21:10
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 5
- https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b Patch
- https://github.com/python-pillow/Pillow/pull/9709 Issue Tracking, Patch
- https://github.com/python-pillow/Pillow/releases/tag/12.3.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq Exploit, Vendor Advisory