CVE-2026-54060 Details
Description
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
A vulnerability in the Pillow library's font processing can cause excessive memory allocation, leading to a denial-of-service condition. This issue arises in versions of Pillow prior to 12.3.0, specifically within the 'PIL/FontFile.py' component. The problem occurs in the 'FontFile.compile()' method, which assembles per-glyph images into a combined bitmap. The method uses 'Image.new("1", (xsize, ysize))' without performing a decompression bomb check, allowing a crafted font to trigger significant memory usage during conversion or saving. The vulnerability is particularly exploitable with BDF fonts, where glyph heights can be manipulated, or PCF fonts, which can be crafted to bypass the library's standard decompression bomb guard.
Users should upgrade to Pillow version 12.3.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| python pillow | < 12.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |