CVE-2026-54058

pillow: Pillow is a Python imaging library

CVE-2026-54058 is fixed in 18 products on 1 platform, first by python3-pil 9.0.1-1ubuntu0.6, released July 14, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

Urgent
CVSS
9.1
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0052
44th percentile

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.

Where it's fixed

ProductFixed inFixReleased
Linux
mingw32-python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw32-python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw64-python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
mingw64-python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
pillow · Debian 14 12.3.0-1 DEBIAN-CVE-2026-54058 Jul 25, 2026
python-Pillow · opensuse-leap 16.0 11.3.0-160000.8.1 OPENSUSE-SU-2026:21544-1 Aug 10, 2026
python-Pillow · sles 15.6 9.5.0-150400.5.25.1 SUSE-SU-2026:3268-1 Jul 27, 2026
python-Pillow · sles 15.7 9.5.0-150400.5.25.1 SUSE-SU-2026:3268-1 Jul 27, 2026
python-Pillow · sles 16.0 11.3.0-160000.8.1 SUSE-SU-2026:23228-1 Aug 10, 2026
python-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow · rocky 8 0:5.1.1-23.el8_10 RLSA-2026:48021 Jul 31, 2026
python-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python-pillow-debugsource · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python-pillow-debugsource · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pil · Ubuntu 22.04.1 LTS (jammy) 9.0.1-1ubuntu0.6 python3-pil 9.0.1-1ubuntu0.6 Jul 14, 2026
python3-pil · Ubuntu 24.04.5 LTS (noble) 10.2.0-1ubuntu1.4 python3-pil 10.2.0-1ubuntu1.4 Jul 14, 2026
python3-pil · Ubuntu 26.04.1 LTS (resolute) 12.1.1-2ubuntu1.4 python3-pil 12.1.1-2ubuntu1.4 Jul 14, 2026
python3-pil.imagetk · Ubuntu 22.04.1 LTS (jammy) 9.0.1-1ubuntu0.6 python3-pil.imagetk 9.0.1-1ubuntu0.6 Jul 14, 2026
python3-pil.imagetk · Ubuntu 24.04.5 LTS (noble) 10.2.0-1ubuntu1.4 python3-pil.imagetk 10.2.0-1ubuntu1.4 Jul 14, 2026
python3-pil.imagetk · Ubuntu 26.04.1 LTS (resolute) 12.1.1-2ubuntu1.4 python3-pil.imagetk 12.1.1-2ubuntu1.4 Jul 14, 2026
python3-pillow · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-devel · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-devel · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-devel · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-devel · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-devel · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-doc · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-doc · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-doc · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-qt · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk · RHEL 8 0:5.1.1-23.el8_10 RHSA-2026:48021 Jul 31, 2026
python3-pillow-tk · almalinux 8 5.1.1-23.el8_10 ALSA-2026:48021 Jul 29, 2026
python3-pillow-tk · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026
python3-pillow-tk · ol 8 0:5.1.1-23.el8_10 ELSA-2026-48021 Jul 30, 2026
python3-pillow-tk-debuginfo · Fedora 43 11.3.0-10.fc43 FEDORA-2026-FC2DED926E Jul 19, 2026
python3-pillow-tk-debuginfo · amzn 2023 9.4.0-2.amzn2023.0.10 ALAS2023-2026-2013 Aug 3, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.