CVE-2026-55379
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Pillow before version 12.3.0, the bdf_char() function in BdfFontFile.py reads the BBX width and height from a BDF font file and passes attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing decompression bomb protection and allowing excessive memory allocation.
Risk Assessment
An attacker can provide a specially crafted BDF font file that causes massive memory allocation, leading to resource exhaustion and potential denial of service (DoS).
Recommendation
Immediately update Pillow to version 12.3.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.