PT-2026-55964 · Python Pillow · Pillow

X-Forwarded-Sudo · Publicado 2026-07-06 · Atualizado 2026-07-06 · CVE-2026-55379

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image. decompression bomb check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Exploit

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2026-55379

Produtos afetados

Pillow

Referências · 4

• 🔥 https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc · Exploit
• https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d · Nota
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55379 · Nota de Segurança