CVE-2026-54059
published 2026-07-06CVE-2026-54059: Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.41%
34.2th percentile
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python-pillow | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | >= 0 < 12.3.0 | 12.3.0 |
| satellite-capsule_el8 | python-pillow | — | — |
| satellite_el8 | python-pillow | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
ghsa·2026-07-20
CVE-2026-54059 [HIGH] CWE-789 Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
## Description
`PIL/PcfFontFile.py` `_load_bitmaps()` (line 227) reads glyph dimensions from the PCF `METRICS` section and passes them directly to `Image.frombytes()` without calling `Image._decompression_bomb_check()`. Dimensions originate from unsigned 16-bit values:
```
xsize = right - left (max: 65535 − 0 = 65535)
ysize = ascent + descent (max: 65535 + 65535 = 131070)
```
Maximum exploitable pixel count: **65,535 × 131,070 = 8,589,734,450 pixels** — **48× the DecompressionBombError threshold**.
**Vulnerable code (`PIL/PcfFontFile.py` line 224–227):**
```python
for i in range(nbitmaps):
xsize, ysize = metrics[i][:2] # from PCF METRICS —
VulDB
Pillow up to 12.2.x PCF Font Parser PIL/PcfFontFile.py _load_bitmaps memory allocation
vuldb·2026-07-06·CVSS 7.5
CVE-2026-54059 [HIGH] Pillow up to 12.2.x PCF Font Parser PIL/PcfFontFile.py _load_bitmaps memory allocation
A vulnerability was found in Pillow up to 12.2.x and classified as problematic. The affected element is the function _load_bitmaps of the file PIL/PcfFontFile.py of the component PCF Font Parser. Executing a manipulation can lead to uncontrolled memory allocation.
This vulnerability is tracked as CVE-2026-54059. The attack can be launched remotely. No exploit exists.
Red Hat
python-pillow: Pillow: Denial of Service via crafted PCF font data
vendor_redhat·2026-07-06·CVSS 7.5
CVE-2026-54059 [HIGH] CWE-409 python-pillow: Pillow: Denial of Service via crafted PCF font data
python-pillow: Pillow: Denial of Service via crafted PCF font data
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or applic
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [fedora-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-54059 [HIGH] CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [fedora-all]
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [epel-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-54059 [HIGH] CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [epel-all]
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data
bugzilla·2026-07-06·CVSS 7.5
CVE-2026-54059 [HIGH] CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data
CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rsthttps://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77dhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9xhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
2026-07-06
Published