Red Hat Security Advisory: python-pillow security update

Fixed packages 12

Vulnerabilities 6

• High 8.3
  CVE-2026-54058

  Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

  Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel a…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 14, 2026
• High 8.2
  CVE-2026-59197

  Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

  Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before …

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 14, 2026
• High 7.5
  CVE-2026-54059

  Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-54060

  Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-55379

  Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-55380

  Pillow GdImageFile decompression bomb protection bypass

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500057
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52551.json
• report
  https://access.redhat.com/security/cve/CVE-2026-54058
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54058
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54058
• article
  https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d
• article
  https://github.com/python-pillow/Pillow/pull/9719
• article
  https://github.com/python-pillow/Pillow/releases/tag/12.3.0
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
• report
  https://access.redhat.com/security/cve/CVE-2026-54059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54059
• article
  https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• article
  https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x
• report
  https://access.redhat.com/security/cve/CVE-2026-54060
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54060
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2
• report
  https://access.redhat.com/security/cve/CVE-2026-55379
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55379
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55379
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc
• report
  https://access.redhat.com/security/cve/CVE-2026-55380
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55380
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55380
• article
  https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
• article
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm
• report
  https://access.redhat.com/security/cve/CVE-2026-59197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59197
• article
  https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1
• article
  https://github.com/python-pillow/Pillow/pull/9695