Skip to content
OpenAdvisories
High RHSA-2026:48760 4 CVEs

Red Hat Security Advisory: python-pillow security update

Published Aug 1, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python-pillow 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python-pillow-debuginfo 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python-pillow-debugsource 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python3-pillow 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python3-pillow-debuginfo 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream python3-pillow-tk-debuginfo 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python-pillow 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python-pillow-debuginfo 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python-pillow-debugsource 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python3-pillow 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python3-pillow-debuginfo 0:5.1.1-20.el8_6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream python3-pillow-tk-debuginfo 0:5.1.1-20.el8_6

Vulnerabilities 4

  • High 7.5
    CVE-2026-54059

    Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-54060

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-55379

    Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-55380

    Pillow GdImageFile decompression bomb protection bypass

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497452
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497455
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497464
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2497466
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48760.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-54059
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54059
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54059
  • article
    https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
  • article
    https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
  • report
    https://access.redhat.com/security/cve/CVE-2026-54060
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54060
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54060
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2
  • report
    https://access.redhat.com/security/cve/CVE-2026-55379
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55379
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55379
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc
  • report
    https://access.redhat.com/security/cve/CVE-2026-55380
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55380
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55380
  • article
    https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm