Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-14T16:07:56
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
CWE-125
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
A flaw was found in Pillow, a Python imaging library. When saving a mode 1 image with TGA RLE compression, the TGA RLE encoder reads beyond its allocated memory buffer. This out-of-bounds read allows adjacent process heap memory to be copied into the generated TGA file, potentially leading to information disclosure.
The impact is limited to information disclosure of adjacent heap memory fragments in the generated output file. Exploitation requires the application to save attacker-influenced images in TGA format with RLE compression, which is an uncommon operation in affected Red Hat products.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Exploit Intelligence
Under investigation
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/lightspeed-stack-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/rag-tool-cpu-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/rag-tool-cuda-12.9-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-ocp-rag-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-service-api-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/model-opt-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/model-opt-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-neuron-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-rocm-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-spyre-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-tpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-cpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-neuron-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-rocm-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-spyre-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-25/lightspeed-chatbot-rhel8
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/hub-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/hub-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
python-pillow
Red Hat Enterprise Linux 7
Under investigation
python-pillow
Red Hat Enterprise Linux 8
Under investigation
python-pillow
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-aws-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-azure-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-azure-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gcp-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/disk-image-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-caikit-nlp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-caikit-tgis-serving-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-agent-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-autogluon-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-controller-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-router-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-storage-initializer-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-llama-stack-core-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-llm-d-inference-scheduler-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-llm-d-kv-cache-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-openvino-model-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-training-cuda128-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-training-rocm64-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat Quay 3
Fix deferred
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
python-pillow
Red Hat Satellite 6
Under investigation
satellite:el8/python-pillow
https://www.cve.org/CVERecord?id=CVE-2026-59198
https://nvd.nist.gov/vuln/detail/CVE-2026-59198
https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
https://github.com/python-pillow/Pillow/pull/9709
https://github.com/python-pillow/Pillow/releases/tag/12.3.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq