RHSA-2026:52551HighCVSS 9.1

Red Hat Security Advisory: python-pillow security update

Published
August 10, 2026
Last Modified
August 10, 2026

🔗 CVE IDs covered (6)

CVE-2026-55379 →CVE-2026-55380 →CVE-2026-59197 →CVE-2026-54058 →CVE-2026-54059 →CVE-2026-54060 →

📋 Description

CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54059 — python-pillow: Pillow: Denial of Service via crafted PCF font data CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python-pillow-0:5.1.1-15.el8_4.2.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python-pillow-0:5.1.1-15.el8_4.2.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python-pillow-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python-pillow-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python-pillow-debugsource-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python-pillow-debugsource-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python3-pillow-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python3-pillow-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python3-pillow-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python3-pillow-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • python3-pillow-tk-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • python3-pillow-tk-debuginfo-0:5.1.1-15.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.

🔗 References (9)