Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python Pillow may write outside memory, causing crashes
published 19 days ago
Summary
The Python Pillow library on Ubuntu can write data past the end of a buffer when handling paste operations near large coordinate values, and it can read past the end of a buffer when opening certain MCIDAS image files with incorrect row settings. This can lead to program crashes or unexpected behavior. Update the Pillow packages (python-pil, python-pil-doc, python-pil.imagetk, python3-pil, python3-pil.imagetk) to the latest version that includes the security patches.
What to do
- Update canonical python-pil to version 5.1.0-1ubuntu0.8+tuxcare.els2.
- Update canonical python-pil-doc to version 5.1.0-1ubuntu0.8+tuxcare.els2.
- Update canonical python-pil.imagetk to version 5.1.0-1ubuntu0.8+tuxcare.els2.
- Update canonical python3-pil to version 5.1.0-1ubuntu0.8+tuxcare.els2.
- Update canonical python3-pil.imagetk to version 5.1.0-1ubuntu0.8+tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | python-pil |
< 5.1.0-1ubuntu0.8+tuxcare.els2 Fix: upgrade to 5.1.0-1ubuntu0.8+tuxcare.els2
|
| TuxCare:Ubuntu:18.04 | canonical | python-pil-doc |
< 5.1.0-1ubuntu0.8+tuxcare.els2 Fix: upgrade to 5.1.0-1ubuntu0.8+tuxcare.els2
|
| TuxCare:Ubuntu:18.04 | canonical | python-pil.imagetk |
< 5.1.0-1ubuntu0.8+tuxcare.els2 Fix: upgrade to 5.1.0-1ubuntu0.8+tuxcare.els2
|
| TuxCare:Ubuntu:18.04 | canonical | python3-pil |
< 5.1.0-1ubuntu0.8+tuxcare.els2 Fix: upgrade to 5.1.0-1ubuntu0.8+tuxcare.els2
|
| TuxCare:Ubuntu:18.04 | canonical | python3-pil.imagetk |
< 5.1.0-1ubuntu0.8+tuxcare.els2 Fix: upgrade to 5.1.0-1ubuntu0.8+tuxcare.els2
|
Original advisory text
Fix CVE(s): CVE-2026-54058, CVE-2026-59199
* SECURITY UPDATE: heap out-of-bounds write via paste box coordinates
near the signed 32-bit integer limits (ELSCVE-233283)
- debian/patches/CVE-2026-59199.patch: compute the paste box
dimensions as int64_t in ImagingPaste() and ImagingFill2() in
src/libImaging/Paste.c. Adds a regression test in
Tests/test_image_paste.py.
- CVE-2026-59199
* SECURITY UPDATE: out-of-bounds read when memory-mapping McIdas AREA
images with an undersized row stride (ELSCVE-233312)
- debian/patches/CVE-2026-54058.patch: raise the row stride to at
least one full row of pixels in PyImaging_MapBuffer() in src/map.c.
Adds a regression test in Tests/test_file_mcidas.py.
- CVE-2026-54058
near the signed 32-bit integer limits (ELSCVE-233283)
- debian/patches/CVE-2026-59199.patch: compute the paste box
dimensions as int64_t in ImagingPaste() and ImagingFill2() in
src/libImaging/Paste.c. Adds a regression test in
Tests/test_image_paste.py.
- CVE-2026-59199
* SECURITY UPDATE: out-of-bounds read when memory-mapping McIdas AREA
images with an undersized row stride (ELSCVE-233312)
- debian/patches/CVE-2026-54058.patch: raise the row stride to at
least one full row of pixels in PyImaging_MapBuffer() in src/map.c.
Adds a regression test in Tests/test_file_mcidas.py.
- CVE-2026-54058
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792164435.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54058 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59199 Vendor Advisory
Timeline
Published16 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792164435 · OSV
Track software like this
Free during beta