CVE-2026-55379: Python Pillow DOS Vulnerability

CVE-2026-55379 Overview

CVE-2026-55379 affects Pillow, the widely used Python imaging library. Versions prior to 12.3.0 fail to invoke the decompression bomb check when parsing Bitmap Distribution Format (BDF) font files. The bdf_char() function in PIL/BdfFontFile.py reads the BBX width and height fields from the font file and passes those attacker-controlled dimensions directly to Image.new(). This bypasses Pillow's documented decompression bomb protection and permits excessive memory allocation from a crafted font file. The issue is fixed in Pillow 12.3.0.

Critical Impact
A crafted BDF font file can trigger unbounded memory allocation in any Python application that parses untrusted fonts with Pillow, causing denial of service through resource exhaustion [CWE-789].

Affected Products

Python Pillow versions prior to 12.3.0
Applications embedding Pillow for BDF font parsing
Downstream Python packages depending on vulnerable Pillow releases

Discovery Timeline

2026-07-06 - CVE-2026-55379 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-55379

Vulnerability Analysis

The vulnerability is a memory allocation flaw classified as CWE-789 (Memory Allocation with Excessive Size Value). Pillow provides Image._decompression_bomb_check() as a documented safeguard against images that expand to disproportionate memory footprints. The BDF font parser skipped this check entirely.

When bdf_char() in src/PIL/BdfFontFile.py processes a glyph, it splits the BBX line into integers representing width, height, and displacement. These values flow directly into Image.new(), which allocates a backing buffer sized by width × height × bytes-per-pixel. An attacker who controls the BDF file controls the allocation size.

Root Cause

The root cause is a missing safety check in the font-loading code path. Pillow's image loaders route through Image.open() and enforce decompression bomb limits, but the font-file classes were not wired into the same protection. The parser trusted the BBX header without validating that the requested dimensions were within Image.MAX_IMAGE_PIXELS.

Attack Vector

An attacker delivers a malicious BDF font file to any service that loads fonts through Pillow. Common vectors include document rendering pipelines, image generation web services, and PDF or ticket generators that accept user-supplied fonts. No authentication or user interaction is required when the parsing service ingests remote input. The result is process-level denial of service through host memory exhaustion.

python

     # and x and y displacement (BBxoff0, BByoff0)
     # of the lower left corner from the origin of the character.
     width, height, x_disp, y_disp = (int(p) for p in props["BBX"].split())
+    Image._decompression_bomb_check((width, height))
 
     # The word DWIDTH
     # followed by the width in x and y of the character in device pixels.

Source: Pillow commit 0a263e6 — the patch adds the missing Image._decompression_bomb_check((width, height)) call so oversized BBX values raise DecompressionBombError before allocation.

Detection Methods for CVE-2026-55379

Indicators of Compromise

BDF font files containing BBX header fields with abnormally large width or height values
Python processes exhibiting sudden memory growth immediately after font parsing calls
Application logs recording MemoryError exceptions originating from PIL.BdfFontFile.bdf_char
Out-of-memory kills of worker processes handling user-supplied font uploads

Detection Strategies

Inventory Python environments and flag installations where pip show pillow reports a version below 12.3.0
Inspect ingested BDF files for BBX dimensions exceeding realistic glyph sizes, for example any value beyond a few hundred pixels
Instrument Pillow calls to capture stack traces when DecompressionBombWarning or DecompressionBombError is raised after upgrade

Monitoring Recommendations

Alert on resident set size spikes in application workers that process fonts or images
Track cgroup and container OOM events correlated with font-processing endpoints
Log Software Bill of Materials (SBOM) diffs so vulnerable Pillow versions are surfaced in dependency scans

How to Mitigate CVE-2026-55379

Immediate Actions Required

Upgrade Pillow to version 12.3.0 or later across all Python environments
Rebuild and redeploy container images that pin an older Pillow release
Restrict font upload endpoints to authenticated users until patching is complete
Enforce per-process memory limits on workers that call into Pillow font APIs

Patch Information

The fix was released in Pillow 12.3.0 through commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d. The commit adds decompression bomb checks to the FontFile classes so oversized BDF dimensions are rejected before allocation. Refer to the GitHub Security Advisory GHSA-45hq-cxwh-f6vc and the Pillow 12.3.0 release notes for full details.

Workarounds

Reject BDF font uploads at the application boundary until Pillow can be upgraded
Pre-validate BBX header values and refuse files whose width or height exceed application-defined limits
Lower Image.MAX_IMAGE_PIXELS in application startup to shrink the acceptable allocation envelope
Run font parsing in an isolated subprocess with a strict RLIMIT_AS memory cap

bash

# Upgrade Pillow to the patched release
pip install --upgrade "Pillow>=12.3.0"

# Verify the installed version
python -c "import PIL; print(PIL.__version__)"

# Optional: constrain worker memory as defense in depth (Linux)
ulimit -v 1048576  # cap virtual memory at ~1 GiB before starting the service