Skip to content
Threat Feed
Subscribe

Tag

Python-Library

2 briefs RSS
high advisory

Pillow BdfFontFile Decompression Bomb Bypass Vulnerability

A vulnerability (CVE-2026-55379) in Pillow's BdfFontFile component allows attackers to craft a malicious BDF font file with oversized BBX dimensions and an empty BITMAP section, bypassing documented decompression bomb protection and causing the Image.new() function to silently allocate large amounts of memory in the C-heap, leading to resource exhaustion and denial-of-service for applications processing untrusted BDF fonts.

pillow vulnerability denial-of-service python heap-overflow integer-overflow image-processing python-library cve-2026-59199 +2
4t 1c
high advisory

Langroid File Tools Path Traversal Vulnerability (CVE-2026-50181)

A path traversal vulnerability (CVE-2026-50181) exists in Langroid's `ReadFileTool` and `WriteFileTool` components (versions <= 0.63.0), allowing an attacker to read or write arbitrary files outside the configured `curr_dir` via crafted `file_path` arguments, potentially leading to sensitive information disclosure or unauthorized file modification in applications exposing these tools to user or LLM input.

langroid path-traversal python-library vulnerability llm-agent
3t