GHSA-8V84-F9PQ-WR9X Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

🗓️ 20 Jul 2026 21:08:27Reported by GoogleType

osv🔗 osv.dev👁 19 Views

Pillow PcfFontFile bypasses decompression bomb check for bitmaps, enabling large allocations.

Reporter	Title	Published	Views	Family All 167
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Pillow which is vulnerable to CVE-2026-54058, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205	29 Sep 202614:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026	31 Jul 202611:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities addressed in IBM watsonx.governance, IBM AI Factsheets, and IBM Watson OpenScale	29 Sep 202607:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	31 Aug 202615:32	–	ibm
attackerkb	CVE-2026-54059	6 Jul 202618:46	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-1985)	20 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3816 (ALAS-2026-3816)	21 Jul 202600:00	–	nessus

Source	Link
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54059
github	www.github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
github	www.github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml
github	www.github.com/python-pillow/Pillow
github	www.github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst

10 Sep 2026 03:51Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00644

Pillow vulnerability PcfFontFile load bitmaps image frombytes decompression bomb bypass large bitmap allocations pcf metrics