CVE-2026-54059

What it actually does

Pillow versions prior to 12.3.0 fail to enforce decompression-bomb protections when loading bitmap glyphs from PCF font files. The vulnerable code path reads glyph dimensions from the PCF METRICS section and passes attacker-controlled values to Image.frombytes(), which can trigger extremely large memory allocation. Successful exploitation causes excessive memory consumption and can crash the Python process, worker, container, or host service that processes the crafted font. The impact is denial of service only; there is no indication that this flaw enables code execution or data disclosure.

Why it matters to the business

Any service, pipeline, API, web application, document processor, image/font conversion workflow, or automation job that accepts or processes untrusted PCF font files using vulnerable Pillow versions can be crashed by a malicious file. In production this can cause service outages, failed processing jobs, resource exhaustion, autoscaling spikes, queue backlogs, and degraded availability for dependent applications. Although it is not listed in CISA KEV and EPSS is currently low, public exploit availability and network-reachable, unauthenticated attack conditions increase the need to patch exposed file-processing services promptly.

How an attack unfolds

An attacker creates a malicious PCF font file with manipulated glyph dimension values in the METRICS section. The attacker then submits or delivers that file to an application component that uses Pillow to parse PCF fonts, such as an upload endpoint, conversion service, document-rendering workflow, preview generator, or background processing job. When the vulnerable Pillow code loads the PCF font, _load_bitmaps() trusts the embedded dimensions and calls Image.frombytes() without applying Image._decompression_bomb_check(). Pillow attempts to allocate memory based on the attacker-controlled dimensions, resulting in excessive memory consumption. The Python process may raise MemoryError, be killed by the operating system or container runtime, or make the service unavailable until restarted or resources recover.

How to fix it

Upgrade Pillow to version 12.3.0 or later wherever it is installed, including application dependencies, build images, serverless packages, containers, notebooks, batch jobs, and transitive dependency bundles. If immediate upgrade is not possible, reduce exposure by blocking or quarantining PCF font uploads from untrusted sources, disabling PCF font parsing features, applying strict file type allowlists, enforcing upload size limits, running file processing in memory- and CPU-limited sandboxes, and isolating worker pools that process untrusted files. Pin dependency versions explicitly and rebuild/redeploy artifacts so the fixed library is actually present at runtime.

How to confirm the fix worked

Confirm all runtime environments use Pillow 12.3.0 or later by checking package metadata with commands such as python -m pip show Pillow, pip freeze, poetry show pillow, pipenv graph, conda list pillow, or container/software composition scans. Validate that deployed artifacts, not only source manifests, contain the fixed version. Review dependency lockfiles and SBOMs for Pillow versions below 12.3.0. For exposure validation, identify services that accept fonts, images, documents, archives, or user-controlled files and determine whether PCF files can reach Pillow parsing paths. Where safe and authorized, use a non-destructive test PCF fixture in a staging environment to confirm processing is rejected or handled without abnormal memory growth.

Typical attack path

1. Identify an internet-facing or otherwise reachable application feature that accepts files, fonts, documents, archives, or image-rendering inputs processed by Python Pillow.
2. Craft a PCF font file with maliciously large glyph dimensions in the PCF METRICS section.
3. Upload, submit, email, or otherwise deliver the crafted PCF file to the vulnerable processing path.
4. Trigger server-side parsing of the PCF file by Pillow prior to version 12.3.0.
5. Cause Image.frombytes() to allocate excessive memory because decompression-bomb checks are not applied for this PCF code path.
6. Crash the Python worker, exhaust container or host memory, or degrade the service until it is restarted, scaled, or patched.

How to detect it

Look for evidence of denial-of-service activity against file-processing paths rather than classic compromise artifacts. Relevant sources include web access logs, API gateway logs, upload service logs, application logs from Python/Pillow workers, container runtime events, Kubernetes events, system logs, process supervisor logs, EDR telemetry, and memory/availability monitoring. Investigate requests or jobs involving PCF font files shortly before process crashes, worker restarts, container OOMKilled events, Linux out-of-memory killer messages, Python MemoryError exceptions, or sudden memory spikes in Pillow-based services. Correlate uploaded filenames, MIME types, request paths, client IPs, user agents, queue job identifiers, and timestamps with service restarts or high memory consumption. If samples are retained, inspect suspicious PCF files in an isolated analysis environment for abnormal METRICS glyph dimensions. Absence of a retained file does not rule out exploitation because the primary artifact may only be transient resource exhaustion.

• .pcf
• application/x-font-pcf
• PIL/PcfFontFile.py
• PIL.PcfFontFile
• PcfFontFile
• _load_bitmaps
• Image.frombytes
• MemoryError
• DecompressionBombWarning
• DecompressionBombError
• Out of memory: Killed process
• Killed process
• oom-kill
• OOMKilled
• Exit Code 137
• exit code 137
• ContainerStatusUnknown
• Back-off restarting failed container

What your security team should do

• Prioritize upgrading Pillow to 12.3.0 or later in all externally exposed file-processing services and shared base images.
• Inventory applications and jobs that process user-supplied files with Python Pillow, especially upload, preview, conversion, rendering, and document-processing workflows.
• Add temporary controls to reject PCF font files and unknown font formats from untrusted sources until all affected deployments are patched.
• Apply memory limits, worker isolation, request timeouts, queue circuit breakers, and automatic worker recycling for file-processing components.
• Search logs and telemetry for recent memory exhaustion, Python MemoryError events, OOM kills, container restarts, and requests involving PCF files or font uploads.
• Update dependency scanning policies to flag Pillow versions below 12.3.0 as high-priority availability risk.
• Rebuild and redeploy containers, serverless bundles, and virtual environments after dependency updates; do not rely only on manifest changes.
• Because public exploit code is available, treat unauthenticated file-processing endpoints as higher urgency even though the CVE is not currently in KEV.