Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-06T18:52:11 python-pillow: Pillow: Denial of Service via crafted BDF font file 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.

A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service. Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Red Hat Enterprise Linux 8 2026-07-14T00:00:00Z RHSA-2026:39127 python-pillow-0:5.1.1-22.el8_10 Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Affected lightspeed-core/lightspeed-stack-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat AI Inference Server Affected rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/model-opt-cuda-rhel9 Red Hat AI Inference Server Will not fix rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Will not fix rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Will not fix rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cuda-rhel9 Red Hat AI Inference Server Will not fix rhaii/vllm-gaudi-rhel9 Red Hat AI Inference Server Will not fix rhaii/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-spyre-rhel9 Red Hat AI Inference Server Will not fix rhaii/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Not affected python-pillow Red Hat Enterprise Linux 7 Not affected python-pillow Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-nlp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-tgis-serving-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-autogluon-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llm-d-kv-cache-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Under investigation python3.12-pillow Red Hat Satellite 6 Affected python-pillow Red Hat Satellite 6 Under investigation satellite-capsule:el8/python-pillow Red Hat Satellite 6 Affected satellite:el8/python-pillow https://www.cve.org/CVERecord?id=CVE-2026-55379 https://nvd.nist.gov/vuln/detail/CVE-2026-55379 https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc