CVE-2026-54058
Publication date 14 July 2026
Last updated 4 November 2026
Ubuntu priority
Description
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| pillow | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Fixed in 12.1.1-2ubuntu1.4
|
|
| 24.04 LTS noble |
Fixed in 10.2.0-1ubuntu1.4
|
|
| 22.04 LTS jammy |
Fixed in 9.0.1-1ubuntu0.6
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| pillow-python2 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
8.3 · High
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Base score
9.1 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8999-1
- Pillow vulnerabilities
- 4 November 2026