Skip to content
OpenAdvisories
Medium USN-8690-1 1 CVE

pillow vulnerability

Published Sep 1, 2026 · Updated Sep 3, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Pillow did not properly manage memory when
processing certain image files. An attacker could possibly use this issue
to cause a denial of service or read sensitive data.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS pillow 9.0.1-1ubuntu0.5
Ubuntu · 24.04 LTS 24.04:LTS pillow 10.2.0-1ubuntu1.3
Ubuntu · 26.04 LTS 26.04:LTS pillow 12.1.1-2ubuntu1.3
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS pillow 7.0.0-4ubuntu0.9+esm1

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-59198

    Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

    Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This iss…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-59198