CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
HIGH 7.5EPSS 0.4%
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
- Affected
- python-pillow · Pillow
- CVSS v3.1 GITHUB
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.42% chance of exploitation in the next 30 days, 35th percentile
- Published
- 2026-07-06
- Updated
- 2026-07-07
Proof-of-concept exploits (1)
Security advisories
- python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2
- python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d