PT-2026-55964 · Python Pillow · Pillow

X-Forwarded-Sudo · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-55379

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image. decompression bomb check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Exploit

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-55379

Affected Products

Pillow

References · 4

• 🔥 https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-55379 · Security Note
• https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d · Note
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst · Note