Skip to content
Threat Feed
Subscribe

Vendor

Pillow Project

1 brief RSS
low advisory

Pillow FontFile.compile() Vulnerability Bypasses Decompression Checks Leading to DoS (CVE-2026-54060)

A vulnerability, CVE-2026-54060, in the Pillow library's `FontFile.compile()` method allows attackers to craft malicious BDF or PCF font files that bypass standard decompression bomb checks, causing an unchecked, massive memory allocation when processed, which can lead to a Denial of Service (DoS) via an Out-Of-Memory (OOM) crash in vulnerable applications.

Pillow vulnerability denial-of-service python software-supply-chain
1t 1c