Red Hat Product Security has released an advisory (RHSA-2026:48021) for python-pillow on Red Hat Enterprise Linux 8, addressing two vulnerabilities: CVE-2026-59197, a native heap out-of-bounds write, and CVE-2026-54058, which allows memory disclosure or denial of service via a crafted McIdas AREA image. These vulnerabilities relate to improper memory handling in the Pillow library. The advisory provides updated packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated as Important by Red Hat and is available for installation to fix these issues.

The vulnerabilities could allow an attacker to cause memory corruption (heap out-of-bounds write), memory disclosure, or denial of service when processing specially crafted images using the Pillow library. This can lead to potential compromise of confidentiality or availability of affected systems running vulnerable versions of python-pillow on Red Hat Enterprise Linux 8.

Red Hat has released updated python-pillow packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:48021 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.