CVE-2026-59198: CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder

#security #cve #cybersecurity

CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder

Vulnerability ID: CVE-2026-59198
CVSS Score: 6.5
Published: 2026-07-20

CVE-2026-59198 is a high-severity heap out-of-bounds read vulnerability in Pillow, the Python imaging library, affecting versions from 5.2.0 up to 12.3.0. The vulnerability occurs in the TGA RLE compression path due to a calculation mismatch between the allocated packed 1-bit row buffer and the byte-level pixel stride assumption in the C-level encoder. This mismatch allows an attacker to leak up to approximately 57 KB of adjacent process heap memory directly into generated TGA image files.

TL;DR

A calculation mismatch in Pillow's TGA RLE encoder allows remote attackers to leak up to 57 KB of process heap memory by saving 1-bit images with RLE compression.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-125
Attack Vector: Network
CVSS v3.1: 6.5 (Medium)
EPSS Score: 0.00313
Impact: Information Disclosure (Heap Leak up to ~57 KB)
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

Pillow (Python Imaging Library)
Pillow: >= 5.2.0, < 12.3.0 (Fixed in: 12.3.0)

Code Analysis

Commit: eada3cb

Prevent saving mode 1 images as TGA with RLE compression

@@ -205,6 +205,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:
         compression = im.encoderinfo.get("compression", im.info.get("compression"))
         rle = compression == "tga_rle"
     if rle:
+        if im.mode == "1":
+            msg = f"cannot write mode {im.mode} as TGA with run-length encoding"
+            raise OSError(msg)
+
         imagetype += 8

Mitigation Strategies

Upgrade Pillow to 12.3.0 or higher
Implement strict image mode validation before saving TGA outputs
Disable TGA RLE compression for untrusted user inputs

Remediation Steps:

Update requirements.txt or dependency configuration to use Pillow>=12.3.0
Execute local test suites to verify that saving 1-bit (mode 1) TGA files with RLE compression raises an OSError exception
Sandbox high-risk image-processing pipelines using isolated worker containers with limited privileges

References

Read the full report for CVE-2026-59198 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community