Skip to content
Threat Feed
Subscribe

Product

Pillow (5.2.0 - 12.2.x)

1 brief RSS
high advisory

Pillow TGA RLE Encoder Out-of-Bounds Read (CVE-2026-59198)

A critical out-of-bounds read vulnerability, CVE-2026-59198, exists in Pillow versions 5.2.0 through 12.2.x, specifically within its TGA RLE encoder, allowing adjacent process heap bytes to be copied into generated TGA files, which can lead to information disclosure.

Pillow vulnerability out-of-bounds-read python
1t 1c