CVE-2026-54058

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description An out-of-bounds read issue exists in the PyImaging MapBuffer() function within src/map.c when loading uncompressed McIdas AREA images from a filename using the mmap raw codec path. The software fails to verify that the row stride is at least the natural row width (xsize * pixelsize). A remote attacker can provide a specially crafted image with header words that set a stride smaller than the row width, causing pixel access operations—such as Image.tobytes(), getpixel, convert, or save—to read beyond the mapped memory region. This can lead to the disclosure of adjacent process memory or cause a denial of service via a SIGBUS fault.

Recommendations Update Pillow to version 12.3.0. As a temporary mitigation, restrict the use of the PyImaging MapBuffer() function or avoid processing uncompressed McIdas AREA images from untrusted sources.