Tetrak
GitHub ↗
Security · Pillow

Pillow's TGA run-length encoder copies heap bytes into the file it writes

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Advisory
CVE-2026-59198
Library
Pillow, pillow on PyPI
Published
Severity
6.5 out of 10, as published
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
on a save path

What triggers it

Image.save(format="TGA", compression="tga_rle") of a mode-1 image.

What sillybos does

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

What rides from the opened file is its mode and its width, and nothing crafted: any bilevel image of any width over-reads once the program saves it as TGA with run-length compression, a choice no scan pipeline makes. A bilevel scan is exactly a mode-1 image, so a policy refusing them would refuse every scan; max_side bounds the over-read's window, which is seven eighths of the width. The file is not the input in any sense a check could act on.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against what rides from an opened file into a save.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Do not save images from outside as run-length TGA; upgrade to Pillow 12.3.0. The check's max_side bounds how far past the row buffer the encoder reads.

The general advice applies to every row here.

Sources