CVE-2026-54060

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description The FontFile.compile() function in the PIL/FontFile.py module fails to call Image. decompression bomb check() when assembling per-glyph images into a combined bitmap using Image.new("1", (xsize, ysize)). This allows a specially crafted font to trigger excessive memory allocation during conversion or saving processes. A decompression bomb is a malicious file designed to crash or freeze a system by consuming excessive resources during decompression.

Recommendations Update to version 12.3.0.