Fluid Attacks Database

Description

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	pillow	=11.1.0-5 \|\| =11.2.1-1 \|\| =11.3.0-1 \|\| =12.0.0-1 \|\| =12.1.0-1 \|\| =12.1.1-1 \|\| =12.1.1-2 \|\| =12.2.0-1 \|\| >=0 <12.3.0-1	12.3.0-1
debian 12	pillow	=10.0.0-1 \|\| =10.1.0-1 \|\| =10.2.0-1 \|\| =10.3.0-1 \|\| =10.3.0-2 \|\| =10.4.0-1 \|\| =10.4.0-1.1 \|\| =11.1.0-1 \|\| =11.1.0-2 \|\| =11.1.0-3 \|\| =11.1.0-4 \|\| =11.1.0-5 \|\| =11.2.1-1 \|\| =11.3.0-1 \|\| =12.0.0-1 \|\| =12.1.0-1 \|\| =12.1.1-1 \|\| =12.1.1-2 \|\| =12.2.0-1 \|\| =12.3.0-1 \|\| =13.0.0-1 \|\| =9.4.0-1.1 \|\| =9.4.0-1.1+deb12u1 \|\| =9.5.0-1	-
debian 13	pillow	=11.1.0-5 \|\| =11.1.0-5+deb13u1 \|\| =11.1.0-5+deb13u2 \|\| =11.1.0-5+deb13u3 \|\| =11.1.0-5+deb13u4 \|\| =11.2.1-1 \|\| =11.3.0-1 \|\| =12.0.0-1 \|\| =12.1.0-1 \|\| =12.1.1-1 \|\| =12.1.1-2 \|\| =12.2.0-1 \|\| =12.3.0-1 \|\| =13.0.0-1	-
rpm rhel8.6	python-pillow	<0:5.1.1-20.el8_6	0:5.1.1-20.el8_6
rpm rhel8	python-pillow	<0:5.1.1-22.el8_10	0:5.1.1-22.el8_10
pypi	pillow	>=0 <12.3.0	12.3.0
rpm rhel8.4	python-pillow	<0:5.1.1-15.el8_4.2	0:5.1.1-15.el8_4.2

Aliases

1. CVE-2026-540602. NVD-2026-540603. OSV-DEBIAN-2026-540604. OSV-2026-540605. GHSA-5x94-69rx-g8h26. GCVE-2026-540607. SECURITY-TRACKER-CVE-2026-54060

References

1. https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h22. https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d3. https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml4. https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.