CVE-2026-55379

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description The bdf char() function in PIL/BdfFontFile.py reads the BBX width and height fields from a BDF font file and passes these attacker-controlled dimensions to Image.new() without invoking Image. decompression bomb check(). This bypasses the documented decompression bomb protection, which is a security mechanism designed to prevent the processing of maliciously crafted files that expand to an enormous size in memory, leading to excessive memory allocation.

Recommendations Update to version 12.3.0.