Detections
Analytics

SCA: security update for pillow (GHSA-462x-pgg6-55fp)

medium Tenable Cloud Security Plugin ID 476406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the
 tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller
 than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond
 that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can
 expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
 (CVE-2026-112395)

Solution

Update the pillow library and its related packages to version 13.0.0 or later.

See Also

https://github.com/advisories/GHSA-462x-pgg6-55fp

Plugin Details

Severity: Medium

ID: 476406

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/21/2026

Updated: 10/21/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 8.22

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2026-112395

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 10/19/2026

Reference Information

CVE: CVE-2026-112395

cwe: CWE-122