Excessive Memory Allocation Vulnerability in Python Pillow Library

CVE-2026-54060

What is CVE-2026-54060?

The Pillow library, a widely used Python imaging tool, contains a significant vulnerability in the FontFile module. Prior to version 12.3.0, the FontFile.compile() function improperly assembled per-glyph images into a single bitmap without conducting necessary decompression bomb checks. This oversight allows attackers to craft malicious fonts capable of triggering excessive memory allocation during image conversion or saving processes, potentially leading to resource exhaustion and denial of service. This critical issue has been addressed in the latest 12.3.0 release.

References