Skip to content
Fencer Vulns
high 7.5

CVE-2026-54059 json

Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

published 2026-07-06 4 mo ago modified 2026-10-25 14 d ago also BIT-pillow-2026-54059 , EUVD-2026-41899 , GHSA-8v84-f9pq-wr9x , PYSEC-2026-2253

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

Patch / fix

  • pypi pillow 12.3.0
  • bitnami pillow 12.3.0
  • python pillow 12.3.0
  • pillow Debian 14 12.3.0-1

debian advisories DEBIAN-CVE-2026-54059

  • pillow Ubuntu 22.04 LTS 9.0.1-1ubuntu0.6
  • pillow Ubuntu 24.04 LTS 10.2.0-1ubuntu1.4
  • pillow Ubuntu 26.04 LTS 12.1.1-2ubuntu1.4

ubuntu advisories UBUNTU-CVE-2026-54059

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.7-1.el8ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.7-1.el9ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.7-1.el8ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.7-1.el9ap
  • python3.12-daphne ansible automation platform 2.5 4.2.2-1.el8ap
  • python3.12-daphne ansible automation platform 2.6, ansible automation platform 2.5 4.2.2-1.el9ap
  • python3.12-pillow ansible automation platform 2.5 12.3.0-1.el8ap
  • python3.12-pillow ansible automation platform 2.6, ansible automation platform 2.5 12.3.0-1.el9ap

red hat advisories RHSA-2026:52551RHSA-2026:50319RHSA-2026:50336RHSA-2026:50263RHSA-2026:50222RHSA-2026:50223

  • python-Pillow SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.5.0-150400.5.25.1
  • python-Pillow SLE Module for Package Hub 15 SP7 7.2.0-150300.3.27.1
  • python-Pillow SLES for SAP applications 16.0, SLES 16.0 11.3.0-160000.6.1

suse advisories SUSE-SU-2026:3268-1SUSE-SU-2026:2875-1SUSE-SU-2026:22626-1

  • python-Pillow openSUSE Tumbleweed 12.3.0-1.1
  • python-Pillow openSUSE Leap 16.0 11.3.0-160000.6.1

opensuse advisories openSUSE-SU-2026:11261-1openSUSE-SU-2026:21296-1

  • python3-pillow AlmaLinux 8 5.1.1-22.el8_10
  • python3-pillow-tk AlmaLinux 8 5.1.1-22.el8_10

almalinux advisories ALSA-2026:39127

  • python-pillow Rocky Linux 8 5.1.1-22.el8_10

rocky linux advisories RLSA-2026:39127

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54059 updated cvss 7.5

python-pillow: Pillow: Denial of Service via crafted PCF font data

  • Red Hat Satellite 6 python-pillow
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-pillow 12.3.0-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-pillow 12.3.0-1.el9ap
    fixed: vendor fix RHSA-2026:50319
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pillow 12.3.0-1.el9ap
    fixed: vendor fix RHSA-2026:50336
  • Red Hat Enterprise Linux AppStream (v. 8) python-pillow 5.1.1-22.el8_10, python3-pillow 5.1.1-22.el8_10
    fixed: vendor fix RHSA-2026:39127
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) python-pillow 5.1.1-15.el8_4.2, python3-pillow 5.1.1-15.el8_4.2
    fixed: vendor fix RHSA-2026:52551
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) python-pillow 5.1.1-20.el8_6, python3-pillow 5.1.1-20.el8_6
    fixed: vendor fix RHSA-2026:48760
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) python-pillow 5.1.1-20.el8_8, python3-pillow 5.1.1-20.el8_8
    fixed: vendor fix RHSA-2026:48759
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python-pillow 5.1.1-15.el8_4.2, python3-pillow 5.1.1-15.el8_4.2
    fixed: vendor fix RHSA-2026:52551
show 8 more
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) python-pillow 5.1.1-20.el8_6, python3-pillow 5.1.1-20.el8_6
    fixed: vendor fix RHSA-2026:48760
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) python-pillow 5.1.1-20.el8_8, python3-pillow 5.1.1-20.el8_8
    fixed: vendor fix RHSA-2026:48759
  • Red Hat Enterprise Linux CRB (v. 8) python3-pillow 5.1.1-22.el8_10, python3-pillow-tk 5.1.1-22.el8_10
    fixed: vendor fix RHSA-2026:39127
  • Red Hat Satellite 6.16 for RHEL 8 python-pillow 12.3.0-1.el8pc, python3.11-pillow 12.3.0-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-pillow 12.3.0-1.el9pc, python3.11-pillow 12.3.0-1.el9pc
    fixed: vendor fix RHSA-2026:50223
  • Red Hat Satellite 6.17 for RHEL 9 python-pillow 12.3.0-1.el9pc, python3.11-pillow 12.3.0-1.el9pc
    fixed: vendor fix RHSA-2026:50222
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-pillow 12.3.0-1.el9pc
    fixed: vendor fix RHSA-2026:50263
  • Red Hat Satellite 6.19 for RHEL 9 python3.12-pillow 12.3.0-1.el9pc
    fixed: vendor fix RHSA-2026:50221
  • Red Hat Ansible Automation Platform 2 python-pillow Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.7-1.el8ap, receptorctl 1.6.7-1.el8ap, automation-hub 4.10.17-1.el8ap, python3.12-daphne 4.2.2-1.el8ap, python3.12-pyasn1 0.6.4-1.el8ap, python3.12-aiohttp 3.14.1-2.el8ap, +17 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.7-1.el9ap, receptorctl 1.6.7-1.el9ap, automation-hub 4.10.17-1.el9ap, python3.12-daphne 4.2.2-1.el9ap, python3.12-pyasn1 0.6.4-1.el9ap, python3.12-aiohttp 3.14.1-2.el9ap, +17 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.7-1.el9ap, receptorctl 1.6.7-1.el9ap, automation-hub 4.11.12-1.el9ap, python3.12-daphne 4.2.2-1.el9ap, python3.12-pyasn1 0.6.4-1.el9ap, ansible-dev-tools 26.7.2-1.el9ap, +34 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.7-1.el10ap, receptorctl 1.6.7-1.el10ap, ansible-dev-tools 26.7.2-1.el10ap, python-tox-ansible 26.7.1-1.el10ap, python3-tox-ansible 26.7.1-1.el10ap, ansible-dev-tools+server 26.7.2-1.el10ap Red Hat Enterprise Linux 7 python-pillow, python-pillow-qt, python-pillow-tk, python-pillow-sane
    +6 more products
    Red Hat Satellite 6 python-pillow Red Hat Satellite 6.16 for RHEL 8 libsolv 0.7.20-7.el8sat, satellite 6.16.12-1.el8sat, python-pyjwt 2.13.0-1.el8pc, python3-solv 0.7.20-7.el8sat, openvox-agent 8.24.1-3.el8sat, openvox-server 8.14.1-1.el8sat, +16 more Red Hat Satellite 6.16 for RHEL 9 satellite 6.16.12-1.el9sat, python-pyjwt 2.13.0-1.el9pc, openvox-agent 8.24.1-3.el9sat, openvox-server 8.14.1-1.el9sat, satellite-cli 6.16.12-1.el9sat, python-pysequoia 0.1.33-1.el9pc, +14 more Red Hat Satellite 6.17 for RHEL 9 satellite 6.17.10-1.el9sat, python-pyjwt 2.13.0-1.el9pc, openvox-agent 8.24.1-3.el9sat, openvox-server 8.14.1-1.el9sat, satellite-cli 6.17.10-1.el9sat, python-pysequoia 0.1.33-1.el9pc, +16 more Red Hat Satellite 6.18 for RHEL 9 satellite 6.18.8-1.el9sat, openvox-agent 8.24.1-3.el9sat, satellite-cli 6.18.8-1.el9sat, openvox-server 8.14.1-1.el9sat, python3.12-pyjwt 2.13.0-1.el9pc, rubygem-faraday 1.10.6-1.el9sat, +14 more Red Hat Satellite 6.19 for RHEL 9 foreman 3.18.0.8-1.el9sat, satellite 6.19.3-1.el9sat, foreman-cli 3.18.0.8-1.el9sat, foreman-ec2 3.18.0.8-1.el9sat, foreman-pcp 3.18.0.8-1.el9sat, satellite-cli 6.19.3-1.el9sat, +22 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi pillow
<12.3.0
12.3.0
bitnami pillow
<12.3.0
12.3.0

Affected products

  • python-pillow Pillow

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.