CVE-2026-54060: Python Pillow DOS Vulnerability

CVE-2026-54060 Overview

CVE-2026-54060 is a denial-of-service vulnerability in Pillow, the widely used Python imaging library. Versions prior to 12.3.0 fail to enforce decompression bomb checks when assembling per-glyph bitmaps in PIL/FontFile.py. The FontFile.compile() function calls Image.new("1", (xsize, ysize)) without validating the resulting dimensions through Image._decompression_bomb_check(). A crafted font file can specify oversized glyph metrics that force Pillow to allocate excessive memory during conversion or save operations. The issue is fixed in Pillow 12.3.0 [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
Applications that process untrusted font files with Pillow can be forced into memory exhaustion, resulting in application crashes or host-level denial of service.

Affected Products

Python Pillow versions prior to 12.3.0
Applications and services embedding vulnerable Pillow releases for font rendering
Web applications, image processing pipelines, and document generators that accept user-supplied fonts

Discovery Timeline

2026-07-06 - CVE-2026-54060 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-54060

Vulnerability Analysis

The flaw resides in Pillow's font handling code path. When FontFile.compile() runs, it iterates over glyph entries and computes a combined bitmap width and height. It then calls Image.new("1", (xsize, ysize)) to allocate a 1-bit image buffer sized to hold every glyph. Pillow provides Image._decompression_bomb_check() to reject implausibly large image dimensions, but this guard was not invoked in the font compilation path.

An attacker who supplies a font with inflated bounding-box or glyph dimensions can force Pillow to request an oversized allocation. The allocation attempt exhausts available memory, terminates the Python process, or degrades the host. Because font parsing typically occurs in server-side rendering pipelines, this creates a network-reachable denial-of-service condition.

Root Cause

The root cause is a missing safety check in PIL/FontFile.py and PIL/BdfFontFile.py. Pillow trusted attacker-controlled font metadata to size an internal image buffer. Without Image._decompression_bomb_check(), no upper bound was applied to the combined bitmap dimensions before allocation.

Attack Vector

Exploitation requires the target application to load a malicious font file through Pillow and invoke compile(), conversion, or save operations. No authentication or user interaction is required when the pipeline accepts remote font uploads. The result is resource exhaustion rather than code execution or data disclosure.

python

# Security patch in src/PIL/BdfFontFile.py
# Add decompression bomb checks to FontFile classes (#9711)
     # and x and y displacement (BBxoff0, BByoff0)
     # of the lower left corner from the origin of the character.
     width, height, x_disp, y_disp = (int(p) for p in props["BBX"].split())
+    Image._decompression_bomb_check((width, height))
 
     # The word DWIDTH
     # followed by the width in x and y of the character in device pixels.

Source: GitHub Commit 0a263e6

python

# Security patch in src/PIL/FontFile.py
# Width accumulation fix for combined bitmap layout
             if glyph:
                 d, dst, src, im = glyph
                 h = max(h, src[3] - src[1])
-                w = w + (src[2] - src[0])
+                w += src[2] - src[0]
                 if w > WIDTH:
                     lines += 1
                     w = src[2] - src[0]

Source: GitHub Commit 0a263e6

Detection Methods for CVE-2026-54060

Indicators of Compromise

Python worker processes terminated by the OS out-of-memory (OOM) killer during font processing
MemoryError exceptions raised from PIL/FontFile.py in application logs
Sudden RSS spikes in services that call ImageFont or FontFile.compile() on user-supplied inputs
Uploaded BDF or PCF font files with abnormally large BBX or glyph bounding box values

Detection Strategies

Inventory Python environments and container images to identify Pillow versions earlier than 12.3.0
Instrument image and font processing services to log resource usage per request
Inspect font uploads before parsing and reject files declaring unrealistic glyph dimensions

Monitoring Recommendations

Alert on repeated OOM kills or Python MemoryError events tied to Pillow stack frames
Track cgroup and container memory pressure metrics on image-processing workloads
Monitor upload endpoints for anomalous file types and size-to-content ratios

How to Mitigate CVE-2026-54060

Immediate Actions Required

Upgrade Pillow to version 12.3.0 or later across all production and development environments
Audit dependency manifests, lockfiles, and container base images for pinned vulnerable Pillow releases
Restrict or disable font upload endpoints until patched versions are deployed

Patch Information

The fix is available in Pillow 12.3.0. The patch adds Image._decompression_bomb_check() calls in PIL/FontFile.py and PIL/BdfFontFile.py so glyph dimensions are validated before allocation. See the GitHub Security Advisory GHSA-5x94-69rx-g8h2, the GitHub Commit 0a263e6, and the GitHub Release Notes 12.3.0 for full details.

Workarounds

Reject untrusted font files at the application boundary until Pillow is upgraded
Enforce strict memory limits on worker processes using cgroups or container resource constraints
Lower Pillow's global Image.MAX_IMAGE_PIXELS threshold to trigger decompression bomb warnings earlier in adjacent image paths

bash

# Upgrade Pillow to a patched release
pip install --upgrade "Pillow>=12.3.0"

# Verify installed version
python -c "import PIL; print(PIL.__version__)"