CVE-2026-55380: Python Pillow DOS Vulnerability

CVE-2026-55380 Overview

CVE-2026-55380 is a denial-of-service vulnerability in Pillow, the widely used Python Imaging Library. Versions prior to 12.3.0 fail to enforce the decompression bomb check when parsing GD 2.x image files. The GdImageFile._open() function in PIL/GdImageFile.py reads image dimensions directly from the GD header and stores them in self._size without calling Image._decompression_bomb_check(). A crafted .gd file with oversized dimensions can trigger excessive C-heap allocation during image loading, exhausting memory on the host process. This weakness is classified as [CWE-789] Memory Allocation with Excessive Size Value. The issue is fixed in Pillow 12.3.0.

Critical Impact
A remote attacker can supply a small malicious .gd file that forces Pillow to allocate arbitrarily large amounts of memory, crashing image-processing services and applications that accept user-uploaded images.

Affected Products

Python Pillow versions prior to 12.3.0
Applications and services that call Image.open() on untrusted .gd files
Web platforms using Pillow for user-uploaded image processing

Discovery Timeline

2026-07-06 - CVE-2026-55380 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-55380

Vulnerability Analysis

Pillow includes a safety mechanism named Image._decompression_bomb_check() that inspects declared image dimensions before memory is allocated for pixel data. When declared pixel counts exceed the configured MAX_IMAGE_PIXELS threshold, Pillow raises DecompressionBombWarning or DecompressionBombError. This guard is applied consistently across most image plug-ins, including JPEG, PNG, and TIFF.

The GD file handler in PIL/GdImageFile.py did not invoke this check. The _open() method parsed the width and height fields from the GD 2.x header using i16be and assigned them directly to self._size. Downstream code then allocated a C-heap buffer sized to those unchecked dimensions, allowing an attacker to force allocations of many gigabytes from a small input file.

Root Cause

The root cause is a missing input-validation step in a single file format handler. The GD plug-in was omitted when the decompression bomb protection was added to Pillow's other image parsers, creating an inconsistent security boundary across supported formats.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker uploads or supplies a crafted .gd file to any endpoint that invokes Pillow to open or identify the file. Confidentiality and integrity are not affected, but availability is impacted through memory exhaustion of the worker process or host.

python

# Security patch in src/PIL/GdImageFile.py
# Add decompression bomb check to GdImageFile (#9693)

 from typing import IO

-from . import ImageFile, ImagePalette, UnidentifiedImageError
+from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
 from ._binary import i16be as i16
 from ._binary import i32be as i32
 from ._typing import StrOrBytesPath

# Source: https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675

The patch imports the Image module so that GdImageFile._open() can call Image._decompression_bomb_check(self._size) after reading the header dimensions. See the GitHub Security Advisory GHSA-phj9-mv4w-65pm for the full fix.

Detection Methods for CVE-2026-55380

Indicators of Compromise

Sudden Python worker process termination with MemoryError or OOM-killer signals during image handling
Uploaded files with the .gd extension or GD 2.x magic bytes (0xFFFE or 0xFFFF header signature)
Spikes in resident set size (RSS) of Pillow-using services following an upload event
Repeated failed image processing tasks originating from a single source IP or account

Detection Strategies

Inventory Python environments and identify installations of python:pillow at versions below 12.3.0 using SBOM tooling or pip list queries.
Instrument image-ingestion endpoints to log file format, declared dimensions, and byte size, then alert on GD files with pixel counts exceeding MAX_IMAGE_PIXELS.
Correlate application logs with host memory metrics to identify allocation spikes tied to specific image uploads.

Monitoring Recommendations

Set memory ceilings and cgroup limits on image-processing workers and alert on OOM kill events.
Track exceptions of type DecompressionBombError and DecompressionBombWarning in application telemetry.
Monitor upload endpoints for unusually small files declaring very large dimensions in their headers.

How to Mitigate CVE-2026-55380

Immediate Actions Required

Upgrade Pillow to version 12.3.0 or later in all Python environments, container images, and CI pipelines.
Audit application code paths that accept user-supplied images and confirm they route through the patched Pillow release.
Reject or sandbox .gd file uploads until the upgrade is verified across production hosts.

Patch Information

The fix is delivered in Pillow 12.3.0. The relevant commit is f39b0ae, which adds the missing Image._decompression_bomb_check() call to GdImageFile._open(). Refer to the Pillow 12.3.0 Release Notes and the GitHub Security Advisory GHSA-phj9-mv4w-65pm for details.

Workarounds

Block .gd files at the upload gateway or web application firewall until Pillow can be upgraded.
Lower Image.MAX_IMAGE_PIXELS in application startup code to constrain memory use for all formats.
Run image-processing workers under strict memory limits so that a bomb attempt terminates only the isolated worker.

bash

# Upgrade Pillow to the patched release
pip install --upgrade "Pillow>=12.3.0"

# Verify the installed version
python -c "import PIL; print(PIL.__version__)"

# Optional: lower the global pixel ceiling in application code
# from PIL import Image
# Image.MAX_IMAGE_PIXELS = 50_000_000