CVE-2026-59198

What it actually does

Pillow versions 5.2.0 through versions before 12.3.0 contain an out-of-bounds read in the TGA run-length encoding path. When an application uses Pillow to save a mode 1 image as a TGA file with RLE compression, the encoder can read beyond the intended packed row buffer and copy adjacent heap memory into the generated TGA output. The primary impact is unintended disclosure of process memory in image files produced by the application; integrity is not affected, and availability impact is limited to possible instability in edge cases.

Why it matters to the business

Applications that generate TGA images using affected Pillow versions could unintentionally leak sensitive data from process memory into image files, such as fragments of user content, tokens, secrets, request data, or other in-memory application data. The practical risk depends on whether the application accepts attacker-controlled image conversion parameters or exposes generated TGA files to users. Although the EPSS score is currently low and the issue is not listed in CISA KEV, public exploit availability increases urgency for internet-facing or multi-tenant services that perform image processing.

How an attack unfolds

An attacker targets an application or service that uses an affected Pillow version to create TGA files with RLE compression. The attacker supplies or causes the application to process a mode 1 image and requests, triggers, or influences export to TGA with RLE enabled. During encoding, Pillow reads past the packed row buffer and includes adjacent heap bytes in the output TGA file. The attacker then retrieves the generated file and inspects the extra bytes for sensitive memory fragments. Successful exploitation depends on application behavior, heap layout, and whether useful secrets are adjacent to the affected buffer, which makes exploitation less deterministic but still potentially high impact for confidentiality.

How to fix it

Upgrade Pillow to version 12.3.0 or later wherever it is used. Rebuild and redeploy applications, containers, virtual environments, serverless packages, and offline batch workers that bundle or vendor Pillow. If immediate upgrade is not possible, mitigate by disabling TGA output, disabling TGA RLE compression, blocking user-controlled conversion to TGA, or preventing mode 1 images from being saved as RLE-compressed TGA files. Treat generated TGA files from vulnerable versions as potentially containing sensitive memory and avoid distributing or retaining them unnecessarily.

How to confirm the fix worked

Confirm that all runtime environments import Pillow version 12.3.0 or later, for example by checking package lockfiles, container image manifests, software composition analysis results, and runtime package versions. Validate that no deployed artifact still contains Pillow versions from 5.2.0 up to but not including 12.3.0. Exercise the relevant image export paths and confirm that TGA RLE generation either uses the fixed library or is disabled. For mitigation-only deployments, test that attempts to export mode 1 images as RLE-compressed TGA files are rejected, converted through a safe path, or saved without the vulnerable encoding option.

Typical attack path

1. Identify an application, API, workflow, or batch process that uses Pillow for image conversion or export.
2. Determine whether the service can save images as TGA with RLE compression or can be influenced to do so.
3. Submit or trigger processing of a mode 1 image that reaches Pillow's vulnerable TGA RLE encoder.
4. Download, capture, or otherwise access the generated TGA file.
5. Inspect the TGA output for bytes copied from adjacent process heap memory.
6. Repeat the operation with varied images or timing to increase the chance of recovering useful memory fragments.

How to detect it

There are no reliable universal indicators of compromise for this vulnerability because exploitation can look like normal image conversion and the leaked data is embedded in generated TGA files. To assess possible prior exploitation, review application, API gateway, object storage, CDN, and file download logs for requests that generated or retrieved TGA files, especially repeated conversions, unusual TGA export activity, or exports from untrusted users. Correlate those events with application versions known to include Pillow 5.2.0 through versions before 12.3.0. Preserve and inspect generated TGA files from the exposure window for unexpected trailing data or embedded fragments that resemble secrets, session tokens, credentials, HTTP headers, JSON, source snippets, or other application memory content. Review Python application logs for image conversion paths involving Pillow and TGA output, but absence of errors or crashes does not rule out exploitation.

What your security team should do

• Prioritize upgrading Pillow to 12.3.0 or later in internet-facing, user-facing, and multi-tenant image processing services.
• Search dependency inventories, SBOMs, virtual environments, container images, and CI/CD build outputs for vulnerable Pillow versions.
• Identify application features that produce TGA files, especially with RLE compression, and disable or restrict them until patched.
• Review recent access to generated TGA files from vulnerable services and assess whether those files could have exposed sensitive memory fragments.
• Purge or quarantine TGA files generated by vulnerable versions if they may have been accessible to untrusted users.
• Add regression tests or policy checks to prevent reintroduction of vulnerable Pillow versions in application builds.
• Monitor for public exploit tooling and any change in KEV status, EPSS trend, or threat actor reporting.