CVE-2026-54059
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Pillow before version 12.3.0, the _load_bitmaps() function in PcfFontFile.py reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation.
Risk Assessment
An attacker can supply a specially crafted PCF font file that, when processed by Pillow, triggers massive memory allocation, leading to resource exhaustion and potential denial of service (DoS).
Recommendation
Immediately upgrade Pillow to version 12.3.0 or later, which includes a fix to prevent excessive memory allocation.
Original NVD description (English source)
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.