Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillowUpgrade python3-pillow-tkUpgrade python3-pillow-docUpgrade python3-pillow-devel | Jul 14, 2026 | Jul 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-pillowUpgrade python-pillow-saneUpgrade python-pillow-develUpgrade python-pillow-docUpgrade python-pillow-tkUpgrade python-pillow-debuginfo | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade python-pillow-debugsourceUpgrade python3-pillowUpgrade python3-pillow-develUpgrade python-pillow-debuginfoUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tkUpgrade python3-pillow-tk-debuginfo | Jul 21, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade python-pillow-debugsourceUpgrade python3-pillow-docUpgrade python3-pillowUpgrade python3-pillow-tkUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow-devel | Jul 15, 2026 | Jul 6, 2026 |
| Rocky_linux | — | Upgrade python3-pillow-tk-debuginfoUpgrade python3-pillowUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tkUpgrade python-pillow-debuginfoUpgrade python-pillow-debugsourceUpgrade python3-pillow-devel | Jul 17, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub