CVE-2026-54060
published 2026-07-06CVE-2026-54060: Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1"…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
35.0th percentile
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
Affected
79 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | >= 0 < 12.3.0 | 12.3.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | model-opt-cuda-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
ghsa·2026-07-20
CVE-2026-54060 [HIGH] CWE-789 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
## Description
`PIL/FontFile.py` `FontFile.compile()` assembles per-glyph images into a single combined bitmap using `Image.new("1", (xsize, ysize))` without calling `Image._decompression_bomb_check()`. This is the base-class method shared by both `BdfFontFile` and `PcfFontFile`, and it is triggered whenever a loaded font is converted to an `ImageFont` or saved.
Neither `BdfFontFile.BdfFontFile(fp)` nor `PcfFontFile.PcfFontFile(fp)` is registered with `Image.register_open()`, so Pillow's standard decompression bomb guard never fires for font objects. The compile step is the final opportunity to check the combined allocation — and it has no check.
**Vulnerable code (`PIL/FontFile.py` lines ~64–92):*
VulDB
Pillow up to 12.2.x FontFile PIL/FontFile.py FontFile.compile allocation of resources
vuldb·2026-07-06·CVSS 7.5
CVE-2026-54060 [HIGH] Pillow up to 12.2.x FontFile PIL/FontFile.py FontFile.compile allocation of resources
A vulnerability was found in Pillow up to 12.2.x. It has been classified as problematic. The impacted element is the function FontFile.compile of the file PIL/FontFile.py of the component FontFile. The manipulation leads to allocation of resources.
This vulnerability is listed as CVE-2026-54060. The attack may be initiated remotely. There is no available exploit.
Red Hat
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
vendor_redhat·2026-07-06·CVSS 7.5
CVE-2026-54060 [HIGH] CWE-1050 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
S
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [epel-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-54060 [HIGH] CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [epel-all]
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [fedora-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-54060 [HIGH] CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [fedora-all]
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
bugzilla·2026-07-06·CVSS 7.5
CVE-2026-54060 [HIGH] CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rsthttps://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77dhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2
2026-07-06
Published