Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-pillow-develUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tkUpgrade python-pillow-debugsourceUpgrade python-pillow-debuginfoUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillow | Aug 10, 2026 | Jul 14, 2026 |
| Ubuntu | — | Upgrade python3-pilUpgrade python3-pil.imagetkUpgrade python3-pil.imagetk (Ubuntu Pro)Upgrade python3-pil (Ubuntu Pro) | Sep 1, 2026 | Sep 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub