Attack Chain

1. An attacker crafts a malicious font file (e.g., a BDF or PCF file) containing multiple glyphs, each configured with specific dimensions (e.g., maximum PCF glyph height of 65,535 pixels and width of 800 pixels). These individual glyph dimensions are carefully chosen to remain below Pillow's default DecompressionBombWarning and DecompressionBombError thresholds.
2. The attacker delivers this crafted font file to a vulnerable application that uses the Pillow library for font processing. This could occur via an upload mechanism to a web font preview service, as part of a document loaded by a server-side rendering engine, or through a font pipeline.
3. The vulnerable application loads the crafted font file using Pillow's BdfFontFile.BdfFontFile(fp) or PcfFontFile.PcfFontFile(fp) methods.
4. Subsequently, the application attempts to process or convert the loaded font, for example, by calling to_imagefont() or save(filename) on the font object.
5. This action internally triggers the FontFile.compile() method, which is responsible for assembling all per-glyph images into a single, large combined bitmap.
6. Within the compile() method, an Image.new("1", (xsize, ysize)) call is executed to create the combined bitmap, but critically, it bypasses the Image._decompression_bomb_check() that would typically prevent excessively large allocations.
7. The unchecked allocation results in a massive memory consumption spike (e.g., 1.6 GB for 256 glyphs at max PCF height, representing 13.4 billion pixels). This rapid and excessive memory request often exceeds available system resources.
8. The application process then crashes due to an Out-Of-Memory (OOM) error, rendering the service unavailable and achieving a Denial of Service (DoS) for the affected system.

Impact

The primary impact of CVE-2026-54060 is a high availability risk, leading to Denial of Service (DoS). Exploiting this vulnerability can cause applications utilizing the Pillow library for font processing to consume an unchecked, massive amount of memory, resulting in Out-Of-Memory (OOM) crashes. Affected scenarios include web services providing font previews, server-side font renderers, or any font pipeline that loads and processes BDF or PCF font files from untrusted sources. For example, a crafted font file can trigger a ~1.6 GB memory allocation, potentially up to 75 times the normal DecompressionBombError threshold, which is sufficient to crash most server-side processes. There is no observed impact on confidentiality or integrity.

Recommendation

• Patch all systems using the Pillow library to version 12.3.0 or later immediately to address CVE-2026-54060.
• Implement strict input validation and sanitization for any user-supplied font files before processing them with Pillow, especially for BDF and PCF formats.
• Monitor application memory usage and process health, particularly for services that handle user-uploaded or externally sourced font files, to detect abnormal memory spikes that could indicate an attempted exploitation of CVE-2026-54060.