SB2026080375 - openEuler 24.03 LTS SP4 update for python-pillow
Published: August 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-54058)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the PyImaging_MapBuffer mmap path used with the McIdas AREA plugin when processing a crafted image file opened from a filename. A remote attacker can supply a specially crafted McIdas AREA image with an undersized row stride to disclose sensitive information or cause a denial of service.
The issue is reachable when Pillow memory-maps an uncompressed raw tile in a mode listed in Image._MAPMODES, and pixel access operations such as Image.tobytes(), getpixel, convert, or save trigger the read.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-59197)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and overwrite heap memory.
The vulnerability exists due to a heap-based buffer overflow in the ImageFilter.RankFilter API and ImagingExpand function when processing a very large odd filter size through public rank-filter classes. A remote attacker can supply a specially crafted filter size to cause a denial of service and overwrite heap memory.
The issue is reachable through documented public classes including RankFilter, MedianFilter, MinFilter, and MaxFilter. If the image is also attacker-supplied, the out-of-bounds value written past the allocation can be influenced by source image border pixels.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-59199)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in Pillow Image.paste(), Image.crop(), and Image.alpha_composite() when processing attacker-controlled image coordinates near signed 32-bit integer limits. A remote attacker can supply crafted coordinate values to cause a denial of service.
The direct Image.paste() path can copy attacker-controlled source pixel data into the out-of-bounds write, and the issue is reachable through documented public APIs without malformed image files.
4) Resource exhaustion (CVE-ID: CVE-2026-59200)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in PdfParser.PdfStream.decode() in Pillow's PdfParser.py when parsing a crafted FlateDecode-compressed PDF stream. A remote attacker can submit a specially crafted PDF file to cause a denial of service.
The issue occurs because zlib.decompress() is called with the PDF stream Length or DL value as an initial buffer hint without limiting the actual decompressed output size.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-59205)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in ImageCmsTransform.apply() when processing a caller-supplied output image whose mode does not match the transform's declared output mode. A remote attacker can supply a crafted output image object to cause a denial of service.
The issue is reachable through Pillow's public ImageCms API, and the source image pixels can influence the bytes written out of bounds.
6) Path traversal (CVE-ID: CVE-2022-22815)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in path_getbbox() function in path.c. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
7) Out-of-bounds read (CVE-ID: CVE-2022-22816)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to buffer over-read during initialization of ImagePath.Path in path_getbbox() function in path.c. A remote attacker can pass a specially crafted file to the affected library and read contents of memory on the system.
Remediation
Install update from vendor's website.