Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillowUpgrade python3-pillow-tkUpgrade python3-pillow-develUpgrade python3-pillow-doc | Jul 14, 2026 | Jul 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-pillowUpgrade python-pillow-develUpgrade python-pillow-debuginfoUpgrade python-pillow-docUpgrade python-pillow-saneUpgrade python-pillow-tk | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade python-pillow-debugsourceUpgrade python3-pillow-debuginfoUpgrade python3-pillow-develUpgrade python3-pillow-tkUpgrade python3-pillowUpgrade python-pillow-debuginfoUpgrade python3-pillow-tk-debuginfo | Jul 21, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade python3-pillow-develUpgrade python3-pillow-tkUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillowUpgrade python3-pillow-docUpgrade python-pillow-debuginfoUpgrade python3-pillow-debuginfo | Jul 15, 2026 | Jul 6, 2026 |
| Rocky_linux | — | Upgrade python3-pillowUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow-develUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tk | Jul 17, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub