CVE-2026-55379
published 2026-07-06CVE-2026-55379: Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
35.0th percentile
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
Affected
79 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | < 12.3.0 | 12.3.0 |
| python | pillow | >= 0 < 12.3.0 | 12.3.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | model-opt-cuda-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
ghsa·2026-07-20
CVE-2026-55379 [HIGH] CWE-789 Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
### Summary
`PIL/BdfFontFile.py` `bdf_char()` (lines 84–88) reads the `BBX width height` field from a BDF font file and passes the dimensions directly to `Image.new()` without calling `Image._decompression_bomb_check()`. This completely bypasses Pillow's documented decompression bomb protection.
`Image.open()` enforces `MAX_IMAGE_PIXELS = 89,478,485` and raises `DecompressionBombError` for images exceeding `2 × MAX = 178,956,970` pixels. The BDF font loading path calls `Image.new()` directly, which only calls `_check_size()` (validates `>= 0`) — no pixel count limit.
**Vulnerable code (`PIL/BdfFontFile.py` lines 84–88):**
```python
# width, height from attacker-cont
VulDB
Pillow up to 12.2.x BDF Font Parser PIL/BdfFontFile.py bdf_char width/height memory allocation
vuldb·2026-07-06·CVSS 7.5
CVE-2026-55379 [HIGH] Pillow up to 12.2.x BDF Font Parser PIL/BdfFontFile.py bdf_char width/height memory allocation
A vulnerability was found in Pillow up to 12.2.x. It has been declared as problematic. This affects the function bdf_char of the file PIL/BdfFontFile.py of the component BDF Font Parser. The manipulation of the argument width/height results in uncontrolled memory allocation.
This vulnerability is cataloged as CVE-2026-55379. The attack may be launched remotely. There is no exploit available.
Red Hat
python-pillow: Pillow: Denial of Service via crafted BDF font file
vendor_redhat·2026-07-06·CVSS 7.5
CVE-2026-55379 [HIGH] CWE-770 python-pillow: Pillow: Denial of Service via crafted BDF font file
python-pillow: Pillow: Denial of Service via crafted BDF font file
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [epel-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-55379 [HIGH] CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [epel-all]
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [fedora-all]
bugzilla·2026-07-07·CVSS 7.5
CVE-2026-55379 [HIGH] CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [fedora-all]
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
Bugzilla
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file
bugzilla·2026-07-06·CVSS 7.5
CVE-2026-55379 [HIGH] CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file
CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rsthttps://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77dhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vchttps://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc
2026-07-06
Published