CVE-2026-55380

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description In the Python imaging library, the GdImageFile. open() function in PIL/GdImageFile.py reads image dimensions from the GD 2.x header and stores them in self. size without invoking Image. decompression bomb check(). This allows a specially crafted .gd file to trigger excessive C-heap allocation during loading, which can lead to a denial of service. C-heap allocation refers to the process of reserving a block of memory in the heap area of the C runtime environment.

Recommendations Update to version 12.3.0.