Memory Allocation Vulnerability in Pillow Python Imaging Library
CVE-2026-55379

7.5HIGH

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
6 July 2026

What is CVE-2026-55379?

The Pillow Python imaging library contains a vulnerability that allows for excessive memory allocation when processing BDF font files. In versions prior to 12.3.0, the bdf_char() function reads width and height fields from a BDF font file and passes these dimensions directly to Image.new() without proper checks. This omission bypasses Pillow's decompression bomb protection mechanism, thereby making the application susceptible to denial-of-service attacks through manipulated font files. Users are encouraged to upgrade to version 12.3.0 or later to safeguard against this issue.

Affected Version(s)

Pillow < 12.3.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/0a263e6264...
x_refsource_MISC
https://github.com/python-pillow/Pillow/blob/main/docs/re...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.