Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-06T18:46:09 python-pillow: Pillow: Denial of Service via crafted PCF font data 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-409

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.

A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow's font loading functionality. Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability. Red Hat Enterprise Linux 8 2026-07-14T00:00:00Z RHSA-2026:39127 python-pillow-0:5.1.1-22.el8_10 Red Hat Ansible Automation Platform 2 Not affected python-pillow Red Hat Enterprise Linux 7 Affected python-pillow Red Hat Satellite 6 Affected python-pillow Red Hat Satellite 6 Affected satellite:el8/python-pillow https://www.cve.org/CVERecord?id=CVE-2026-54059 https://nvd.nist.gov/vuln/detail/CVE-2026-54059 https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x