CVE-2026-54058 is an out-of-bounds read vulnerability (CWE-125) in the Pillow Python imaging library. Specifically, when Pillow loads an uncompressed McIdas AREA image from a filename using the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. This causes pixel access operations such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped memory region. This memory access can disclose adjacent process memory or cause faults. The vulnerability affects all Pillow versions prior to 12.3.0 and has a CVSS 4.0 score of 8.3 (high severity). The issue is fixed in version 12.3.0.

Exploitation of this vulnerability can result in disclosure of adjacent process memory contents or application faults due to out-of-bounds reads. This can lead to leakage of sensitive information from process memory. No evidence of known exploits in the wild is reported.

Upgrade to Pillow version 12.3.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is in 12.3.0.