CVE-2026-55380: Pillow GD Image Decompression Bomb Denial of Service

Technical summary

CVE-2026-55380 stems from insufficient input validation in PIL/GdImageFile.py's _open() method. The vulnerability occurs because the function extracts image dimensions directly from the GD 2.x file header and stores them in self._size without invoking the safety check Image._decompression_bomb_check(). This function normally prevents pathological dimension values from triggering excessive memory allocation. By omitting this validation for GD files specifically, an attacker can supply crafted dimension values—such as extremely large width and height fields—that cause the C heap allocator to request gigabytes of memory when the image is processed. This is a classic decompression bomb variant applied to heap allocation rather than decompressed data size.

Business impact

Organizations relying on Pillow for image processing—including web frameworks, document conversion pipelines, and automated image manipulation services—face a denial-of-service risk. An unauthenticated attacker can submit a specially crafted .gd file that exhausts server memory, causing application crashes or service unavailability. This is particularly concerning in multi-tenant environments, API gateways, and cloud services where user-supplied image uploads are processed. The attack requires no authentication or user interaction beyond file submission, making it a straightforward exploitation vector for disruption.

Affected systems

Any system running Pillow versions prior to 12.3.0 is vulnerable. This includes Python applications across web frameworks (Django, Flask), content management systems, automated batch processing tools, and microservices that handle image uploads or format conversion. The vulnerability is not hardware- or OS-specific; it affects Pillow on Linux, Windows, macOS, and other platforms where Python runs. Systems that process untrusted image files are at highest risk.

Exploitability

Exploitability is straightforward. The attack vector requires only network access—no special privileges, no user interaction, and no local access required. An attacker simply needs to submit a malicious .gd file to any system that processes GD images with a vulnerable Pillow version. The CVSS score of 7.5 reflects the high severity due to the ease of exploitation, lack of preconditions, and guaranteed denial-of-service impact. However, note that exploiting this requires the target application to actually attempt to open GD files; applications that restrict file formats or validate file types before processing may have reduced risk. The CWE-789 classification (Uncontrolled Memory Allocation) accurately describes the root cause.

Remediation

Update Pillow to version 12.3.0 or later. Administrators should treat this as a priority update for any system that processes images from untrusted sources. Additionally, consider implementing defense-in-depth controls: file type validation and allowlisting (reject .gd files if not explicitly needed), input sanitization, memory limits per process, and request timeouts to catch memory exhaustion attempts early. For applications that do not require GD file support, disabling or removing GD codec support entirely eliminates the risk.

Patch guidance

Update Pillow using your standard Python dependency management toolchain. For pip: pip install --upgrade Pillow>=12.3.0. For conda: conda update pillow. For package managers (apt, yum, brew): update via the system package manager once the vendor has released 12.3.0 in their repository. Verify the patched version is installed by running 'python -c "import PIL; print(PIL.__version__)"' and confirming it returns 12.3.0 or later. Test image processing workflows post-update to ensure compatibility. Organizations using pinned dependencies should update their lock files and re-test in a staging environment before rolling out to production.

Detection guidance

Monitor for anomalous memory consumption spikes coinciding with image file uploads or processing. Examine application logs for failed image open operations or out-of-memory errors when processing .gd files. Network detection is limited; the malicious file is indistinguishable from a legitimate one without analyzing its header. Consider logging the Pillow version at application startup and alerting if it falls below 12.3.0. For forensic analysis, inspect uploaded .gd files for suspiciously large dimension values in the header (typically found in the first 256 bytes). Endpoint detection and response (EDR) tools can flag memory exhaustion patterns, though this may trigger on legitimate workloads as well.

Why prioritize this

Patch this vulnerability promptly, particularly if your organization processes user-supplied image files. The combination of unauthenticated network exploitability (CVSS vector AV:N), no user interaction required (UI:N), and high availability impact (A:H) makes this a priority. The fact that it is not yet in CISA's KEV catalog suggests it may have lower immediate weaponization pressure, but the simplicity of exploitation means public proof-of-concept code or automated scanning tools could emerge quickly. Prioritize systems handling external image uploads, web APIs, and automated document processing.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no prerequisites. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates an attacker can trigger an availability impact from the network with low complexity and no authentication. There is no confidentiality or integrity impact (the attacker cannot read data or modify system state), only crash or hang the service. The score appropriately conveys urgency without overstating the risk profile; this is a serious disruption vector but not a credential theft or code execution vulnerability.

Frequently asked questions