-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Pillow | pip | = 9.1.0 | 9.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the TGA RLE decoding logic in ImagingTgaRleDecode. The GitHub patch adds 'bytes -= n' to track remaining data correctly. Before this fix, when handling literal packets that cross scan lines (memcpy to state->buffer), the code would advance the pointer (ptr += n) but not reduce the available bytes counter, leading to buffer over-reads. This matches the CWE-120 description and the commit's purpose of 'reducing bytes left' when crossing scan lines. The vulnerability is clearly localized to this function based on the patch diff and CVE details.
PythonPython