---
cve: "CVE-2026-54058"
severity: "HIGH"
cvss: 8.3
epss: "0.5%"
vendor: "python-pillow"
kev: false
exploited: false
published: "2026-07-14 17:17:03"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T13:45:24+01:00"
---

# CVE-2026-54058

> 8.3 HIGH · 🧪 PoC

## Beschreibung

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-07-14 17:54:25
- CNA-CVSS: **8.3** (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-125** — Out-of-bounds Read
  The product reads data past the end, or before the beginning, of the intended buffer.

## Angriffsmuster (CAPEC)

- [CAPEC-540 — Overread Buffers](https://capec.mitre.org/data/definitions/540.html) _(Severity: High)_

## Patch verfügbar (OSV)

- bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d (Commit)
- 6a8de891fb00968e5ea79bfa84368ed90b3cfc1d (Commit)

## BSI-Hinweise (deutsch)

- [Red Hat Enterprise Linux (Pillow): Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2592) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (Pillow) ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Daten zu manipulieren.

## Referenzen

- <https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93>
- <https://github.com/python-pillow/Pillow/pull/9719>
- <https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d>
- <https://github.com/python-pillow/Pillow/releases/tag/12.3.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-54058/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_