CyberRota Analysis
AI-GeneratedPillow, a Python imaging library, is vulnerable to a memory access issue when loading uncompressed McIdas AREA images prior to version 12.3.0, allowing attackers to manipulate header words and potentially read beyond the mapped memory region. This can lead to the disclosure of adjacent process memory or application faults during pixel access operations. Developers and organizations using affected versions of Pillow should prioritize upgrading to version 12.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)