CVE-2026-54059: Pillow PCF Font Memory Exhaustion DoS Vulnerability

Technical summary

CVE-2026-54059 stems from insufficient input validation in Pillow's PCF (Portable Compiled Format) font file parser. Specifically, the _load_bitmaps() function in PIL/PcfFontFile.py extracts glyph dimension metadata from the PCF METRICS section and passes those values directly to Image.frombytes() without invoking the decompression bomb check safeguard. This oversight permits an attacker to specify arbitrarily large glyph dimensions in a crafted PCF file, causing Image.frombytes() to allocate memory far beyond reasonable limits. The underlying weakness is a failure to constrain resource allocation based on untrusted input, classified as CWE-789 (Memory Issues). The fix in version 12.3.0 introduces proper bounds checking before memory allocation.

Business impact

Organizations distributing or processing untrusted font files—such as design studios, publishing platforms, web rendering services, or any application accepting user-supplied fonts—face denial-of-service risk. A successful exploit can render services unavailable, disrupt batch processing workflows, or cause unexpected crashes in client applications. For cloud-based or containerized deployments with strict memory limits, a single malicious font file could exhaust all available resources. Indirect exposure is also possible if third-party libraries or dependencies use Pillow to handle fonts without explicit user awareness.

Affected systems

Python Pillow versions prior to 12.3.0 are affected. This includes all production deployments running Pillow 12.2.x, 12.1.x, 12.0.x, and earlier versions. Any system or application that processes PCF font files via Pillow is vulnerable—this encompasses web services, image processing pipelines, document converters, graphic design tools, and any Python application that ingests fonts without restrictive file type or size controls.

Exploitability

Exploitation is straightforward and requires no special conditions. The attack vector is network-based (CVSS AV:N), with no authentication required (PR:N) and no user interaction needed (UI:N). An attacker can distribute a malicious PCF font file via email, a compromised website, a package repository, or any content delivery mechanism. Any system or service that automatically parses or displays fonts from untrusted sources is immediately at risk. The low complexity of crafting a poisoned PCF file and the ease of distribution make this a practical threat.

Remediation

Upgrade Pillow to version 12.3.0 or later as soon as possible. Verify the upgrade in your Python environment by running `pip list | grep -i pillow` or checking the version programmatically via `from PIL import __version__`. For organizations unable to patch immediately, implement input validation by restricting accepted font file types to known-safe formats, enforcing strict file size limits on uploaded fonts, and disabling automatic font loading from untrusted sources. Consider sandboxing or containerizing font processing with resource quotas to limit blast radius.

Patch guidance

Pillow 12.3.0 or later contains the remediation. Verify your current version with `python -c 'from PIL import __version__; print(__version__)'`. Update using your package manager (`pip install --upgrade Pillow`) or your project's dependency declaration file (requirements.txt, pyproject.toml, etc.). After patching, restart all services and applications that depend on Pillow to ensure the updated code is loaded. Test with a sample of existing font files to confirm no compatibility regressions in your workflow.

Detection guidance

Monitor for unexpected memory spikes or out-of-memory errors correlated with font file processing. Enable application logging in Pillow or wrap font-loading code with exception handlers to capture and log MemoryError or PIL.UnidentifiedImageError exceptions, including the filename and timestamp. On network sensors, flag unusual file transfers involving .pcf font files to high-risk or previously unseen destinations. In containerized environments, alert on memory limit breaches during font ingestion tasks. Forensically examine any .pcf files that triggered memory errors to identify anomalous METRICS section entries with unrealistic dimension values.

Why prioritize this

Despite being unassigned to CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits immediate attention due to its high CVSS score (7.5), network-exploitable nature, and the ubiquity of Pillow in Python ecosystems. The absence of exploitation barriers (no authentication, user interaction, or privilege escalation required) combined with the simplicity of weapon creation makes this a credible denial-of-service vector. Organizations with user-facing services or automated workflows that process fonts should prioritize this patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable denial-of-service vulnerability with no user interaction required. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates low attack complexity, no confidentiality or integrity impact (C:N, I:N), but high availability impact (A:H). The absence of scope change (S:U) limits the score slightly, but the unrestricted network accessibility and practical exploitability justify the HIGH severity designation.

Frequently asked questions