SB2026081353 - Red Hat Enterprise Linux 8 update for python-pillow
Published: August 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-59197)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and overwrite heap memory.
The vulnerability exists due to a heap-based buffer overflow in the ImageFilter.RankFilter API and ImagingExpand function when processing a very large odd filter size through public rank-filter classes. A remote attacker can supply a specially crafted filter size to cause a denial of service and overwrite heap memory.
The issue is reachable through documented public classes including RankFilter, MedianFilter, MinFilter, and MaxFilter. If the image is also attacker-supplied, the out-of-bounds value written past the allocation can be influenced by source image border pixels.
2) Out-of-bounds read (CVE-ID: CVE-2026-54058)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the PyImaging_MapBuffer mmap path used with the McIdas AREA plugin when processing a crafted image file opened from a filename. A remote attacker can supply a specially crafted McIdas AREA image with an undersized row stride to disclose sensitive information or cause a denial of service.
The issue is reachable when Pillow memory-maps an uncompressed raw tile in a mode listed in Image._MAPMODES, and pixel access operations such as Image.tobytes(), getpixel, convert, or save trigger the read.
Remediation
Install update from vendor's website.