Detections
Analytics
Chainguard: openstack-horizon-2025.2: security update to 25.5.2_git20260914-r12
critical Tenable Cloud Security Plugin ID 476887
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-
heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a
usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of
the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile
to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and
may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64
KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors
are unaffected. This issue is fixed in version 13.0.0. (CVE-2026-112393)
Solution
Update the openstack-horizon-2025.2 library and its related packages to version 25.5.2_git20260914-r12 or later.Plugin Details
Severity: Critical
ID: 476887
Version: Revision 1.1
Type: Local
Family: Chainguard Local Security Checks
Published: 10/23/2026
Updated: 10/23/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.52
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-112393
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.2
Threat Score: 7.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/19/2026
Reference Information
CVE: CVE-2026-112393