RHSA-2026:48759HighCVSS 7.5

Red Hat Security Advisory: python-pillow security update

Published
July 31, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (4)

CVE-2026-54059 →CVE-2026-54060 →CVE-2026-55379 →CVE-2026-55380 →

📋 Description

CVE-2026-54059 — python-pillow: Pillow: Denial of Service via crafted PCF font data CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python-pillow-0:5.1.1-20.el8_8.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python-pillow-0:5.1.1-20.el8_8.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python-pillow-debuginfo-0:5.1.1-20.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python-pillow-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python-pillow-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python-pillow-debugsource-0:5.1.1-20.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python-pillow-debugsource-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python-pillow-debugsource-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python3-pillow-0:5.1.1-20.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python3-pillow-debuginfo-0:5.1.1-20.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • python3-pillow-tk-debuginfo-0:5.1.1-20.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-tk-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • python3-pillow-tk-debuginfo-0:5.1.1-20.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.

🔗 References (7)