Heap Buffer Overflow in Pillow TGA RLE Encoder

Executive Summary

CVE-2026-59198 is a vulnerability in the Python Imaging Library (Pillow) that affects versions 5.2.0 through 12.2.0. The issue occurs when saving a mode 1 (black and white) image with TGA run-length encoding (RLE) compression.

The TGA RLE encoder incorrectly reads past its packed row buffer because it treats each pixel as a full byte, even though mode 1 images use a packed row buffer of ceil(width / 8) bytes. This causes the encoder to copy adjacent process heap bytes into the generated TGA file, leading to a heap out-of-bounds read.

The vulnerability was fixed in version 12.3.0 by preventing users from saving mode 1 images with TGA RLE compression. Instead, an error is raised to avoid undefined behavior or potential information disclosure.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking for the presence of vulnerable versions of the Pillow library in your Python environment and identifying any attempts to save mode 1 (black and white) images with TGA RLE compression, which could indicate exploitation or misconfiguration.

• Check the installed version of Pillow: Run 'pip show pillow' or 'pip list | grep pillow' to verify the installed version. If the version is between 5.2.0 and 12.2.0, your system is vulnerable.
• Inspect Python scripts or applications for code that saves mode 1 images with TGA RLE compression. Look for calls to the Pillow library's save() method with parameters like 'format=TGA' and 'compression=tga_rle' for mode 1 images.
• Monitor for error messages or crashes when saving mode 1 images with TGA RLE compression. The fixed version (12.3.0 and later) will raise an OSError with the message 'cannot write mode 1 as TGA with run-length encoding.'
• Review TGA files generated by your applications for unexpected or sensitive data. The vulnerability may cause adjacent heap bytes to be written into the output file, which could include sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in the following ways:

• Information disclosure: An attacker could exploit this flaw to read adjacent heap memory from your process and include it in the generated TGA file. This could expose sensitive data, such as encryption keys, credentials, or other confidential information.
• Potential crashes or undefined behavior: If the out-of-bounds read accesses invalid memory, it could cause your application to crash or behave unpredictably.
• Malicious file generation: If an attacker tricks your application into processing a crafted input, they could generate TGA files containing unintended data from your process memory.

The impact is primarily on confidentiality, as the CVSS score of 6.5 indicates. The vulnerability does not directly allow code execution or privilege escalation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR: If the exposed heap memory contains personal data of EU citizens, this vulnerability could lead to a data breach. GDPR requires organizations to implement appropriate technical measures to protect personal data, and failure to patch this vulnerability could be seen as a violation of Article 32 (security of processing).
• HIPAA: For organizations handling protected health information (PHI) in the U.S., this vulnerability could result in unauthorized disclosure of PHI. HIPAA's Security Rule requires covered entities to implement safeguards to protect the confidentiality of electronic PHI. Exploiting this vulnerability could be considered a breach under HIPAA.
• Other standards: Compliance frameworks like ISO 27001, NIST SP 800-53, or PCI DSS require organizations to maintain secure systems and protect sensitive data. This vulnerability could be viewed as a failure to meet these requirements if it leads to data exposure.

To maintain compliance, organizations should update Pillow to version 12.3.0 or later and ensure that any applications processing sensitive data are not vulnerable to this issue.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Pillow to version 12.3.0 or later. This version includes the fix for the vulnerability and prevents mode 1 images from being saved with TGA RLE compression. Use the command 'pip install --upgrade pillow' to update the library.
• If upgrading is not immediately possible, avoid saving mode 1 images with TGA RLE compression. Modify any code that attempts to do so to use a different format or compression method.
• Review and audit your applications for any usage of the Pillow library's save() method with TGA format and RLE compression. Ensure that mode 1 images are not being processed in this way.
• Monitor for any unusual behavior or crashes when saving TGA files, as these could indicate attempts to exploit the vulnerability. Implement logging to track such events.
• If you suspect that sensitive data may have been exposed due to this vulnerability, conduct a thorough review of the generated TGA files for any unintended data leakage.

Useful 0 Not Useful 0