CVE-2026-55380 Python CVE debrief

Who should care

Developers and administrators using Pillow in their applications should be aware of this vulnerability and ensure they are using version 12.3.0 or later to prevent potential exploitation. This includes reviewing and validating input .gd files, implementing additional monitoring for potential exploitation attempts, and confirming whether affected product deployments exist in managed environments.

Technical summary

The vulnerability exists in the GdImageFile._open() method of Pillow's GdImageFile.py, where image dimensions are read from the GD 2.x header and stored in self._size without calling Image._decompression_bomb_check(). This allows a crafted .gd file to trigger excessive C-heap allocation when loaded. The issue is addressed in Pillow version 12.3.0. The vulnerability affects Pillow, a Python imaging library, and can lead to excessive C-heap allocation when loading crafted .gd files.

Defensive priority

High priority should be given to updating Pillow to version 12.3.0 or later, especially in environments where .gd files are processed. This includes reviewing and validating input .gd files, implementing additional monitoring for potential exploitation attempts, and confirming whether affected product deployments exist in managed environments.

Recommended defensive actions

• Update Pillow to version 12.3.0 or later
• Review and validate input .gd files
• Implement additional monitoring for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-06T19:17:08.703Z and was last modified on 2026-07-07T18:58:54.647Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Pillow, a Python imaging library. The issue arises from the library's handling of GD 2.x image files, which can lead to excessive C-heap allocation when loading crafted .gd files. The vulnerability is fixed in Pillow version 12.3.0. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Official resources