PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54060 python-pillow CVE debrief

The Pillow Python imaging library, prior to version 12.3.0, contains a vulnerability in the FontFile.compile() function. This function assembles per-glyph images into a combined bitmap using Image.new('1', (xsize, ysize)) without calling Image._decompression_bomb_check(). This omission allows a malicious font to trigger excessive allocation during conversion or saving, potentially leading to a denial-of-service attack. The issue has been fixed in Pillow version 12.3.0. Developers and administrators should be aware of this vulnerability, particularly in environments where untrusted fonts or images are processed.

Vendor
python-pillow
Product
Pillow
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-06
Original CVE updated
2026-07-07
Advisory published
2026-07-06
Advisory updated
2026-07-07

Who should care

Developers and administrators using the Pillow library in their Python applications should be aware of this vulnerability. This issue is particularly relevant for environments where untrusted fonts or images are processed, as it could lead to potential denial-of-service attacks. Operators, platform administrators, and security teams should review the vulnerability details and plan for mitigation.

Technical summary

The vulnerability exists in the FontFile.py file within the Pillow library. Specifically, the FontFile.compile() method is vulnerable because it creates a new image using Image.new('1', (xsize, ysize)) without performing the necessary Image._decompression_bomb_check(). This check is crucial for preventing excessive memory allocation that could be triggered by maliciously crafted fonts. The vulnerability's CVSS score is 7.5, indicating a high severity level. Affected systems should be updated to Pillow version 12.3.0 or later.

Defensive priority

High

Recommended defensive actions

  • Update Pillow to version 12.3.0 or later
  • Validate and sanitize font files before processing
  • Implement memory usage monitoring for Pillow operations
  • Consider using compensating controls such as rate limiting for image or font processing
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-06T19:17:08.270Z and was last modified on 2026-07-07T18:58:45.827Z. The NVD entry is currently Analyzed. The vulnerability is tracked under CWE-789. There is limited information available about the specific details of the vulnerability, and defenders should verify the affected scope and severity with the official CVE record and vendor advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54060 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54060

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54060 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54060

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.