Is CVE-2026-55379 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-55379?

CVE-2026-55379 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-55379

Description

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.