Critical Security Update for python3-pillow: Addressing Heap Out-of-Bounds Write and Memory Disclosure Vulnerabilities
Summary
ALSA-2026:48021: Important: python-pillow security update. Affects python3-pillow versions < 5.1.1-23.el8_10. Fixed in 5.1.1-23.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python3-pillow is a widely used Python Imaging Library (PIL) fork that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving various image file formats. The library is essential for developers who require image handling in their applications. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities in python3-pillow stem from a native heap out-of-bounds write (CVE-2026-59197) and a memory disclosure or denial of service issue via crafted McIdas AREA images (CVE-2026-54058). These vulnerabilities can lead to unauthorized access to sensitive data or application crashes, potentially allowing attackers to exploit the affected systems.
How To Fix
Minimum fixed version
5.1.1-23.el8_10
This is the first release that contains the fix.
sudo dnf update python3-pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to applications that utilize the vulnerable package until the update can be applied. Additionally, validate and sanitize any image files processed by the application to mitigate potential exploitation.
Conclusion
The vulnerabilities in python3-pillow pose significant risks to applications that rely on this library for image processing. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for python3-pillow →
FAQ
python3-pillow is a Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving image files.
The vulnerabilities include a heap out-of-bounds write and a memory disclosure issue, which could lead to unauthorized data access or application crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing access restrictions to the affected applications and validate any image files processed to reduce the risk of exploitation.
For more details, refer to the CVE pages listed in the references section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
