PT-2026-55962 · Python Pillow · Pillow

X-Forwarded-Sudo · Publicado 2026-07-06 · Atualizado 2026-07-06 · CVE-2026-54059

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py load bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image. decompression bomb check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2026-54059

Produtos afetados

Pillow

Referências · 4

• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst · Nota
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x · Nota
• https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54059 · Nota de Segurança