{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/pillow-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54060"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pillow (\u003c 12.3.0)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","denial-of-service","python","pillow","software-supply-chain"],"_cs_type":"advisory","_cs_vendors":["Pillow Project"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-54060, has been identified in the Pillow image processing library (versions prior to 12.3.0). Specifically, the \u003ccode\u003eFontFile.compile()\u003c/code\u003e method, used by both \u003ccode\u003eBdfFontFile\u003c/code\u003e and \u003ccode\u003ePcfFontFile\u003c/code\u003e to assemble per-glyph images into a single combined bitmap, fails to invoke the \u003ccode\u003eImage._decompression_bomb_check()\u003c/code\u003e. This oversight allows an attacker to craft a malicious font file (e.g., BDF or PCF format) where individual glyphs are small enough to evade existing checks, but their combined size results in an uncontrolled, massive memory allocation upon compilation. For instance, a font with 256 glyphs, each claiming a height of 65,535 pixels, can trigger an allocation of approximately 1.6 GB, potentially reaching 13.4 billion pixels. This vulnerability can be triggered in applications that process user-supplied font files, such as web font preview services or server-side font renderers, leading to application crashes and Denial of Service (DoS) due to Out-Of-Memory (OOM) errors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious font file (e.g., a BDF or PCF file) containing multiple glyphs, each configured with specific dimensions (e.g., maximum PCF glyph height of 65,535 pixels and width of 800 pixels). These individual glyph dimensions are carefully chosen to remain below Pillow's default \u003ccode\u003eDecompressionBombWarning\u003c/code\u003e and \u003ccode\u003eDecompressionBombError\u003c/code\u003e thresholds.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this crafted font file to a vulnerable application that uses the Pillow library for font processing. This could occur via an upload mechanism to a web font preview service, as part of a document loaded by a server-side rendering engine, or through a font pipeline.\u003c/li\u003e\n\u003cli\u003eThe vulnerable application loads the crafted font file using Pillow's \u003ccode\u003eBdfFontFile.BdfFontFile(fp)\u003c/code\u003e or \u003ccode\u003ePcfFontFile.PcfFontFile(fp)\u003c/code\u003e methods.\u003c/li\u003e\n\u003cli\u003eSubsequently, the application attempts to process or convert the loaded font, for example, by calling \u003ccode\u003eto_imagefont()\u003c/code\u003e or \u003ccode\u003esave(filename)\u003c/code\u003e on the font object.\u003c/li\u003e\n\u003cli\u003eThis action internally triggers the \u003ccode\u003eFontFile.compile()\u003c/code\u003e method, which is responsible for assembling all per-glyph images into a single, large combined bitmap.\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003ecompile()\u003c/code\u003e method, an \u003ccode\u003eImage.new(\u0026quot;1\u0026quot;, (xsize, ysize))\u003c/code\u003e call is executed to create the combined bitmap, but critically, it bypasses the \u003ccode\u003eImage._decompression_bomb_check()\u003c/code\u003e that would typically prevent excessively large allocations.\u003c/li\u003e\n\u003cli\u003eThe unchecked allocation results in a massive memory consumption spike (e.g., 1.6 GB for 256 glyphs at max PCF height, representing 13.4 billion pixels). This rapid and excessive memory request often exceeds available system resources.\u003c/li\u003e\n\u003cli\u003eThe application process then crashes due to an Out-Of-Memory (OOM) error, rendering the service unavailable and achieving a Denial of Service (DoS) for the affected system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of CVE-2026-54060 is a high availability risk, leading to Denial of Service (DoS). Exploiting this vulnerability can cause applications utilizing the Pillow library for font processing to consume an unchecked, massive amount of memory, resulting in Out-Of-Memory (OOM) crashes. Affected scenarios include web services providing font previews, server-side font renderers, or any font pipeline that loads and processes BDF or PCF font files from untrusted sources. For example, a crafted font file can trigger a ~1.6 GB memory allocation, potentially up to 75 times the normal \u003ccode\u003eDecompressionBombError\u003c/code\u003e threshold, which is sufficient to crash most server-side processes. There is no observed impact on confidentiality or integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all systems using the Pillow library to version 12.3.0 or later immediately to address CVE-2026-54060.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for any user-supplied font files before processing them with Pillow, especially for BDF and PCF formats.\u003c/li\u003e\n\u003cli\u003eMonitor application memory usage and process health, particularly for services that handle user-uploaded or externally sourced font files, to detect abnormal memory spikes that could indicate an attempted exploitation of CVE-2026-54060.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:14:58Z","date_published":"2026-07-20T21:14:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pillow-fontfile-compile-dos/","summary":"A vulnerability, CVE-2026-54060, in the Pillow library's `FontFile.compile()` method allows attackers to craft malicious BDF or PCF font files that bypass standard decompression bomb checks, causing an unchecked, massive memory allocation when processed, which can lead to a Denial of Service (DoS) via an Out-Of-Memory (OOM) crash in vulnerable applications.","title":"Pillow FontFile.compile() Vulnerability Bypasses Decompression Checks Leading to DoS (CVE-2026-54060)","url":"https://feed.craftedsignal.io/briefs/2026-07-pillow-fontfile-compile-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Pillow Project","version":"https://jsonfeed.org/version/1.1"}