Dino320

**Name of the Vulnerable Software and Affected Versions** Pillow versions prior to 12.3.0 **Description** The `FontFile.compile()` function in the `PIL/FontFile.py` module fails to call `Image. decompression bomb check()` when assembling per-glyph images into a combined bitmap using `Image.new("1", (xsize, ysize))`. This allows a specially crafted font to trigger excessive memory allocation during conversion or saving processes. A decompression bomb is a malicious file designed to crash or freeze a system by consuming excessive resources during decompression. **Recommendations** Update to version 12.3.0.