CVE-2026-54060: Pillow: güvenlik açığı

Açıklama (NVD)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

Özet bilgiler

Ürün

Python Pillow

CVSS v3.1

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

%0,42 (yüzdelik 36)

CWE

CWE-789

Yama

Mevcut

Etkilenen sürümler

İlgili haberler

• USN-8999-1: Pillow vulnerabilities

Kaynaklar

• NVD kaydı
• github.com
• github.com
• github.com
• github.com
• CWE-789