PT-2026-55962 · Python Pillow · Pillow

X-Forwarded-Sudo · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-54059

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py load bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image. decompression bomb check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-54059

Affected Products

Pillow

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54059 · Security Note
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst · Note
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x · Note
• https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d · Note