{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-59199/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-55379"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pillow (\u003c 12.3.0)"],"_cs_severities":["high"],"_cs_tags":["pillow","vulnerability","denial-of-service","python","heap-overflow","integer-overflow","image-processing","python-library","cve-2026-59199","rce","dos"],"_cs_type":"advisory","_cs_vendors":["Pillow"],"content_html":"\u003cp\u003eThe Pillow imaging library, a critical component in many Python applications, contains a denial-of-service vulnerability (CVE-2026-55379) in its \u003ccode\u003eBdfFontFile\u003c/code\u003e component, affecting versions prior to 12.3.0. This flaw allows an attacker to bypass Pillow's documented decompression bomb protection mechanism by crafting a malicious BDF font file. Specifically, when a BDF file defines a glyph with excessively large dimensions in its \u003ccode\u003eBBX\u003c/code\u003e field (e.g., \u003ccode\u003e20000 20000\u003c/code\u003e) but an empty \u003ccode\u003eBITMAP\u003c/code\u003e section, the \u003ccode\u003eImage.frombytes()\u003c/code\u003e call fails. The fallback \u003ccode\u003eImage.new()\u003c/code\u003e function then allocates a substantial amount of memory in the C-heap (e.g., 50 MB for a single glyph) without performing the necessary \u003ccode\u003e_decompression_bomb_check()\u003c/code\u003e. This silent, unbounded memory allocation, especially when combined with multiple such glyphs, can quickly exhaust system resources, leading to a denial-of-service condition for any application that processes untrusted BDF fonts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a specially malicious BDF font file containing glyph definitions.\u003c/li\u003e\n\u003cli\u003eFor each target glyph, the attacker sets an extremely large \u003ccode\u003eBBX\u003c/code\u003e (bounding box) width and height, such as \u003ccode\u003eBBX 20000 20000\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker ensures the \u003ccode\u003eBITMAP\u003c/code\u003e section for these glyphs is left empty, forcing a specific error condition during parsing.\u003c/li\u003e\n\u003cli\u003eA vulnerable application, using a Pillow version older than 12.3.0, attempts to load this malicious BDF font file via \u003ccode\u003eImageFont.load()\u003c/code\u003e or \u003ccode\u003eBdfFontFile()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDuring the \u003ccode\u003ebdf_char()\u003c/code\u003e function's processing of the malicious glyph, \u003ccode\u003eImage.frombytes()\u003c/code\u003e is called.\u003c/li\u003e\n\u003cli\u003eDue to the empty \u003ccode\u003eBITMAP\u003c/code\u003e section, \u003ccode\u003eImage.frombytes()\u003c/code\u003e raises a \u003ccode\u003eValueError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe code then executes a fallback: \u003ccode\u003eImage.new(\u0026quot;1\u0026quot;, (width, height))\u003c/code\u003e is called with the attacker-controlled large dimensions.\u003c/li\u003e\n\u003cli\u003eCrucially, \u003ccode\u003eImage.new()\u003c/code\u003e in this specific code path does not invoke Pillow's \u003ccode\u003e_decompression_bomb_check()\u003c/code\u003e, leading to silent, massive C-heap memory allocation (e.g., ~50 MB per \u003ccode\u003e20000x20000\u003c/code\u003e glyph). Repeated allocations from multiple glyphs (e.g., 256 glyphs allocating ~1.95 GB) cause resource exhaustion and a denial-of-service condition for the application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is a high risk to availability. An attacker can trigger unbounded memory allocation in applications that process untrusted BDF font files. A single malicious BDF glyph can cause tens of megabytes of memory allocation, and multiple glyphs can quickly lead to gigabytes of memory consumption (e.g., 256 glyphs causing 1.95 GB allocation) in the C-heap. This resource exhaustion results in denial-of-service, crashing the application or the host system. Any service loading BDF fonts from untrusted sources (e.g., \u003ccode\u003eImageFont.load(\u0026quot;user.bdf\u0026quot;)\u003c/code\u003e, \u003ccode\u003eBdfFontFile(fp)\u003c/code\u003e) is affected, regardless of the underlying operating system. The allocated glyph images persist in memory for the lifetime of the font object, preventing immediate memory recovery.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected systems by upgrading the Pillow library to version 12.3.0 or later immediately to address CVE-2026-55379.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization for all BDF font files processed by applications to prevent untrusted or malformed files from being loaded, thereby mitigating the risk described in CVE-2026-55379.\u003c/li\u003e\n\u003cli\u003eMonitor applications that process image or font files for sudden, anomalous spikes in memory consumption, which could indicate a resource exhaustion attack exploiting this type of vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T23:20:04Z","date_published":"2026-07-20T21:14:14Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pillow-bdf-bomb-bypass/","summary":"A vulnerability (CVE-2026-55379) in Pillow's BdfFontFile component allows attackers to craft a malicious BDF font file with oversized BBX dimensions and an empty BITMAP section, bypassing documented decompression bomb protection and causing the Image.new() function to silently allocate large amounts of memory in the C-heap, leading to resource exhaustion and denial-of-service for applications processing untrusted BDF fonts.","title":"Pillow BdfFontFile Decompression Bomb Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-pillow-bdf-bomb-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-59199","version":"https://jsonfeed.org/version/1.1"}