PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54059 Python CVE debrief

CVE-2026-54059 is a HIGH severity vulnerability in Pillow, a Python imaging library. The issue arises from the _load_bitmaps() function in PcfFontFile.py, which reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation. The vulnerability is fixed in Pillow version 12.3.0. Affected users should update to this version and review their handling of PCF font data.

Vendor
Python
Product
Pillow
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-06
Original CVE updated
2026-07-07
Advisory published
2026-07-06
Advisory updated
2026-07-07

Who should care

Users of Pillow, a Python imaging library, should be aware of this vulnerability if they handle PCF font data, especially in environments where memory allocation can be a concern. This includes developers and administrators responsible for maintaining systems that utilize Pillow for image processing.

Technical summary

The vulnerability exists in the _load_bitmaps() function of PcfFontFile.py in Pillow versions prior to 12.3.0. This function reads glyph dimensions from the PCF METRICS section of PCF font files and uses these dimensions to allocate memory for images without properly checking for potential decompression bombs. An attacker could exploit this by providing crafted PCF font data that causes excessive memory allocation, potentially leading to a denial-of-service (DoS) attack. The fix in version 12.3.0 involves calling Image._decompression_bomb_check() before allocating memory based on glyph dimensions.

Defensive priority

High

Recommended defensive actions

  • Update Pillow to version 12.3.0 or later
  • Review and validate PCF font data before processing
  • Implement memory usage monitoring for Pillow operations
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-06T19:17:08.127Z and was last modified on 2026-07-07T18:58:26.730Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect additional details not included in the corpus. Further verification is recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54059 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54059

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54059 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54059

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.