{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-59198","sourceIdentifier":"security-advisories@github.com","published":"2026-07-14T16:17:01.797","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0."},{"lang":"es","value":"Pillow es una biblioteca de imágenes de Python. Desde 5.2.0 hasta 12.3.0, el codificador TGA RLE de Pillow lee más allá de su búfer de fila empaquetada al guardar una imagen en modo 1 con compresión TGA RLE, permitiendo que bytes adyacentes del heap del proceso sean copiados al archivo TGA generado. Este problema está solucionado en la versión 12.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-pillow","product":"Pillow","versions":[{"version":"\u003e= 5.2.0, \u003c 12.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-14T19:44:23.310384Z","id":"CVE-2026-59198","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"12.3.0","matchCriteriaId":"71FC37FA-5F2C-493F-B29E-6FEFAF36680F"}]}]}],"references":[{"url":"https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/python-pillow/Pillow/pull/9709","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}