CVE-2026-54059: Python Pillow DOS Vulnerability

CVE-2026-54059 Overview

CVE-2026-54059 is a memory exhaustion vulnerability in Pillow, a widely used Python imaging library. Versions prior to 12.3.0 contain a flaw in PIL/PcfFontFile.py where the _load_bitmaps() function reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes(). The code omits a call to Image._decompression_bomb_check(), allowing crafted PCF font files to trigger excessive memory allocation. The issue is classified as CWE-789 (Memory Allocation with Excessive Size Value) and is fixed in Pillow 12.3.0.

Critical Impact
A remote attacker can supply a malicious PCF font file to trigger uncontrolled memory allocation, exhausting host resources and causing denial of service in applications that parse untrusted fonts.

Affected Products

Python Pillow versions prior to 12.3.0
Applications and services that parse untrusted PCF (Portable Compiled Format) fonts via Pillow
Downstream Python packages bundling vulnerable Pillow releases

Discovery Timeline

2026-07-06 - CVE-2026-54059 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-54059

Vulnerability Analysis

The defect resides in Pillow's PCF font parser. Within PIL/PcfFontFile.py, the _load_bitmaps() function extracts glyph width and height values directly from the PCF METRICS section of the input file. These attacker-controlled integers are then forwarded to Image.frombytes() without any sanity check on the resulting pixel volume.

Pillow provides a dedicated helper, Image._decompression_bomb_check(), precisely to reject image dimensions that would lead to unreasonable memory allocations. The PCF loader never invokes this helper, so a crafted font declaring very large glyph metrics forces the interpreter to allocate the corresponding buffer. The result is a decompression-bomb style denial of service against any process that reads the file.

Root Cause

The root cause is missing input validation on externally sourced size values, mapped to [CWE-789]. Pillow trusts glyph dimensions parsed from the font file rather than bounding them against the decompression bomb threshold applied elsewhere in the library. The same class of oversight was present in BdfFontFile.py, which was corrected in the same patch series.

Attack Vector

Exploitation requires no authentication or user interaction. Any workflow that renders or introspects a PCF font supplied over the network — image processing pipelines, document converters, web upload handlers, or font previewers — can be targeted. Delivering a single crafted PCF file causes the worker process to allocate memory proportional to the attacker-declared glyph dimensions, terminating the process or destabilizing the host.

python

# Security patch in src/PIL/BdfFontFile.py (companion fix in the same commit)
# and x and y displacement (BBxoff0, BByoff0)
# of the lower left corner from the origin of the character.
width, height, x_disp, y_disp = (int(p) for p in props["BBX"].split())
+   Image._decompression_bomb_check((width, height))

# The word DWIDTH
# followed by the width in x and y of the character in device pixels.

Source: Pillow Commit 0a263e6264aa

The patch adds Image._decompression_bomb_check((width, height)) immediately after parsing glyph metrics, forcing dimensions to pass the same bomb threshold used elsewhere in Pillow.

Detection Methods for CVE-2026-54059

Indicators of Compromise

Python worker processes terminating with MemoryError or OOM-killer entries after processing font uploads
PCF font files with abnormally large METRICS width or height fields relative to normal glyph sizes
Sudden spikes in resident memory usage tied to processes importing PIL.PcfFontFile
Repeated crashes of image or document conversion services following uploads of .pcf files

Detection Strategies

Inventory Python environments and flag installations of Pillow < 12.3.0 using pip list or software bill of materials tooling
Inspect application logs for stack traces originating in PIL/PcfFontFile.py_load_bitmaps()
Add file-type inspection on ingress points that accept fonts, and reject PCF files exceeding size or metric thresholds
Correlate cgroup or container OOM events with recent font parsing activity in application telemetry

Monitoring Recommendations

Alert on sustained memory growth in worker processes that handle user-supplied images or fonts
Track Linux oom-kill kernel events and map them to services that link Pillow
Log all uploads of files with PCF magic bytes (\\x01fcp) and review anomalies
Monitor dependency scanners for new advisories referencing GHSA-8v84-f9pq-wr9x

How to Mitigate CVE-2026-54059

Immediate Actions Required

Upgrade Pillow to version 12.3.0 or later across all Python environments and container images
Rebuild and redeploy any application images that pin vulnerable Pillow releases
Restrict or disable PCF font ingestion in services that do not require it
Isolate font-processing workers with strict memory limits until patching is complete

Patch Information

The fix is delivered in Pillow 12.3.0. Commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d introduces Image._decompression_bomb_check() calls in the FontFile classes. Reference the GitHub Security Advisory GHSA-8v84-f9pq-wr9x and the Pillow Release Notes 12.3.0 for full details.

Workarounds

Reject PCF uploads at the application boundary until Pillow is upgraded
Enforce per-process memory limits using cgroups, ulimit -v, or container resource caps
Lower PIL.Image.MAX_IMAGE_PIXELS to a value appropriate for expected workloads to trigger existing bomb protection paths
Run font parsing workers in short-lived, sandboxed processes that can be safely killed on resource exhaustion

bash

# Configuration example: upgrade Pillow and verify version
pip install --upgrade 'Pillow>=12.3.0'
python -c "import PIL; print(PIL.__version__)"

# Optional runtime hardening for font-parsing workers
ulimit -v 1048576   # cap virtual memory at 1 GB per process