Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without…
Priority HIGH 72CWE-789Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.
Summary
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Pillow (python-pillow): 12.3.0pillow (PyPI): 12.3.0Red Hat: 10 advisoriesRed Hat: 16 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | Pillow | before 12.3.0 | 12.3.0 | Patch available | CNA |
| — | pillow (PyPI) | before 12.3.0 | 12.3.0 | Patch available | GHSA-8v84-f9pq-wr9x |
- Pillow Vendorpython-pillow Affected before 12.3.0 Fixed in 12.3.0 Patch available CNA
- pillow (PyPI) Vendor— Affected before 12.3.0 Fixed in 12.3.0 Patch available GHSA-8v84-f9pq-wr9x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | before 12.3.0 | Vulnerable | python-pillow |
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions before 12.3.0 Vulnerable ·python-pillow
Remediation
- Fix · CNA Pillow (python-pillow) Fixed in 12.3.0
- Fix · GHSA-8v84-f9pq-wr9x pillow (PyPI) Fixed in 12.3.0 Advisory →
Red Hat 10 advisories
- RHSA-2026:52551 Released 2026-08-10 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) python-pillow-5.1.1-15.el8_4.2, python3-pillow-5.1.1-15.el8_4.2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python-pillow-5.1.1-15.el8_4.2, python3-pillow-5.1.1-15.el8_4.2
- RHSA-2026:50336 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
- RHSA-2026:50319 Released 2026-08-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.31-1.el8ap, automation-eda-controller-1.1.21-1.el8ap, automation-eda-controller-base-1.1.21-1.el8ap +11
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.31-1.el9ap, automation-eda-controller-1.1.21-1.el9ap, automation-eda-controller-base-1.1.21-1.el9ap +11
Show 7 more Red Hat advisories
- RHSA-2026:50263 Released 2026-08-04 · Red Hat rating ImportantSatellite 6.18.8 Async Update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc +5
- RHSA-2026:50223 Released 2026-08-04 · Red Hat rating ImportantSatellite 6.16.12 Async Update
- Red Hat Satellite 6.16 for RHEL 8 libsolv-1:0.7.20-7.el8sat, openvox-agent-8.24.1-3.el8sat, openvox-server-8.14.1-1.el8sat +9
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
- RHSA-2026:50222 Released 2026-08-04 · Red Hat rating ImportantSatellite 6.17.10 Async Update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
- RHSA-2026:50221 Released 2026-08-04 · Red Hat rating ImportantSatellite 6.19.3 Async Update
- Red Hat Satellite 6.19 for RHEL 9 openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc, rubygem-faraday-1.10.6-1.el9sat +2
- RHSA-2026:48759 Released 2026-07-31 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) python-pillow-5.1.1-20.el8_8, python3-pillow-5.1.1-20.el8_8
- Red Hat Enterprise Linux AppStream TUS (v.8.8) python-pillow-5.1.1-20.el8_8, python3-pillow-5.1.1-20.el8_8
- RHSA-2026:48760 Released 2026-07-31 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) python-pillow-5.1.1-20.el8_6, python3-pillow-5.1.1-20.el8_6
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) python-pillow-5.1.1-20.el8_6, python3-pillow-5.1.1-20.el8_6
- RHSA-2026:39127 Released 2026-07-14 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-22.el8_10, python3-pillow-5.1.1-22.el8_10
- Red Hat Enterprise Linux CRB (v. 8) python3-pillow-5.1.1-22.el8_10, python3-pillow-devel-5.1.1-22.el8_10, python3-pillow-doc-5.1.1-22.el8_10 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:50319 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:50319 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:50336 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:39127 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:52551 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:48760 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:48759 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:52551 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:48760 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:48759 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:39127 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:50223 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:50223 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:50222 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:50263 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:50221 |
Not affected: 12 products
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Enterprise Linux 7
- Red Hat Satellite 6
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54059
- 2026-10-03 Alias added: GHSA-8v84-f9pq-wr9x
References
More python-pillow Pillow vulnerabilities
- TI-2026-76627 Out-of-bounds read in Pillow TIFF encoder ColorMap handling CVSS 4.0HIGH 8.8
- TI-2026-76625 Quadratic-time denial of service in Pillow PDF save_all CVSS 4.0HIGH 8.7
- TI-2026-76605 NULL pointer dereference in Pillow's Image.merge function CVSS 4.0HIGH 8.7
- TI-2026-76604 Out-of-bounds read in Pillow TIFF decoding leaks heap memory CVSS 4.0HIGH 8.8
- TI-2026-76602 Double free in Pillow ImagingScaleAffine on allocation failure CVSS 4.0HIGH 8.7
- TI-2026-76600 GIF seek in Pillow keeps rejected size, allowing denial of service CVSS 4.0HIGH 8.7
Sources
- CVE-2026-54059 · CVE Program
- CVE-2026-54059 · NVD
- FIRST EPSS
- GHSA-8v84-f9pq-wr9x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-54059 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences