Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillow-develUpgrade python3-pillow-tkUpgrade python3-pillow-docUpgrade python3-pillow | Jul 14, 2026 | Jul 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-pillow-saneUpgrade python-pillow-debuginfoUpgrade python-pillowUpgrade python-pillow-docUpgrade python-pillow-tkUpgrade python-pillow-devel | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow-develUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tkUpgrade python-pillow-debugsourceUpgrade python3-pillow | Jul 21, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade python3-pillow-docUpgrade python3-pillowUpgrade python-pillow-debuginfoUpgrade python3-pillow-develUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-tkUpgrade python3-pillow-debuginfo | Jul 15, 2026 | Jul 6, 2026 |
| Rocky_linux | — | Upgrade python3-pillow-tkUpgrade python3-pillow-debuginfoUpgrade python-pillow-debugsourceUpgrade python-pillow-debuginfoUpgrade python3-pillowUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-devel | Jul 17, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub