Is CVE-2026-55380 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-55380?

CVE-2026-55380 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-55380

Description

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.