python-pillow: Pillow: Denial of Service via crafted PCF font data

🗓️ 04 Aug 2026 16:11:20Reported by RedHatType

redhat🔗 access.redhat.com👁 20 Views

Pillow can suffer a denial of service from crafted PCF font data due to unchecked decompression bombs.

Reporter	Title	Published	Views	Family All 167
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Pillow which is vulnerable to CVE-2026-54058, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205	29 Sep 202614:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026	31 Jul 202611:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities addressed in IBM watsonx.governance, IBM AI Factsheets, and IBM Watson OpenScale	29 Sep 202607:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	31 Aug 202615:32	–	ibm
attackerkb	CVE-2026-54059	6 Jul 202618:46	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-1985)	20 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3816 (ALAS-2026-3816)	21 Jul 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	x86_64	python3.12-pillow	12.3.0-1.el9pc	python3.12-pillow-12.3.0-1.el9pc.x86_64.rpm
Red Hat Enterprise Linux	9	x86_64	python3.12-pillow-debuginfo	12.3.0-1.el9pc	python3.12-pillow-debuginfo-12.3.0-1.el9pc.x86_64.rpm
Red Hat Enterprise Linux	9	x86_64	python3.12-pillow-debugsource	12.3.0-1.el9pc	python3.12-pillow-debugsource-12.3.0-1.el9pc.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-54059
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
github	www.github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54059
cve	www.cve.org/CVERecord

28 Sep 2026 02:03Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.00644

SSVC

Pillow Denial of service PCF font data Decompression bombs Memory usage Python imaging library