Python Pillow CVE-2026-59198

Exploitation requires the host application to save an image in Pillow's 1-bit mode '1' using the TGA format with run-length encoding enabled (compression='tga_rle') on an affected version (5.2.0 through 12.2.x), and the attacker must be able to obtain the resulting TGA file. It does NOT trigger on other image modes, on uncompressed TGA saves, or on formats other than TGA-with-RLE, and the attacker cannot choose which heap bytes leak - only a bounded run of adjacent process memory is exposed. The key limiting factor is that the vulnerable save configuration is uncommon and typically controlled by the application, not the attacker, so despite the PR:N/AC:L CVSS metrics this is not exploitable against a default deployment unless the app specifically performs mode-1 tga_rle encoding on attacker-reachable data.

Signals conflict and should be read carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H) yields 7.5 and implies trivial remote confidentiality loss, but the description makes clear exploitation requires an application to save a mode '1' image with TGA RLE compression - an operation an attacker rarely controls directly, so real-world attack complexity is higher than AC:L suggests and the network vector is indirect at best. There is no KEV listing and no EPSS score supplied, and the only public code is the vendor fix itself (a PR/commit), not a weaponized exploit, so this is 'no public exploit identified at time of analysis.' The leaked data is a bounded amount of adjacent heap, not attacker-chosen memory, so confidentiality impact is realistically limited (I judge C:L, not C:H). Net: a legitimate memory-disclosure bug worth patching, but a low-urgency issue rather than an emergency - closer to high-CVSS-but-modest-real-risk unless an application both auto-produces mode-1 tga_rle output and exposes it to an attacker.

An application uses Pillow to convert user-uploaded or generated 1-bit bitmaps to compressed TGA (compression='tga_rle') and then returns the resulting file to the requester. Because the RLE encoder overreads the packed row buffer, the returned TGA contains stray bytes of the server process's heap, which an attacker can harvest across many requests to reconstruct fragments of secrets. No public exploit or POC is known; only the vendor fix diff is available.