Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillow-tkUpgrade python3-pillowUpgrade python3-pillow-develUpgrade python3-pillow-doc | Jul 14, 2026 | Jul 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-pillow-debuginfoUpgrade python-pillow-docUpgrade python-pillow-tkUpgrade python-pillow-develUpgrade python-pillowUpgrade python-pillow-sane | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-pillow-tkUpgrade python3-pillow-debuginfoUpgrade python3-pillow-develUpgrade python-pillow-debugsourceUpgrade python3-pillow-tk-debuginfoUpgrade python-pillow-debuginfoUpgrade python3-pillow | Jul 21, 2026 | Jul 6, 2026 |
| Redhat_linux | — | Upgrade python3-pillow-tk-debuginfoUpgrade python3-pillow-tkUpgrade python3-pillow-develUpgrade python3-pillow-debuginfoUpgrade python3-pillow-docUpgrade python-pillow-debuginfoUpgrade python3-pillowUpgrade python-pillow-debugsource | Jul 15, 2026 | Jul 6, 2026 |
| Rocky_linux | — | Upgrade python-pillow-debugsourceUpgrade python3-pillow-tkUpgrade python3-pillowUpgrade python-pillow-debuginfoUpgrade python3-pillow-debuginfoUpgrade python3-pillow-develUpgrade python3-pillow-tk-debuginfo | Jul 17, 2026 | Jul 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub