CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library versions 5.2.0 to 12.2.0 are vulnerable due to a flaw in the TGA RLE encoder that allows it to read beyond its allocated buffer, potentially leading to the inclusion of adjacent process heap data in generated TGA files. This vulnerability could lead to information disclosure or exploitation in applications that utilize Pillow for image processing. Developers and organizations using affected versions of Pillow should prioritize upgrading to version 12.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)