CVE-2026-54060

FAUCET Score

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

First published: Jul 6, 2026Last modified: Jul 6, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 12.3.0CPE matchmatch criteria	cpe:2.3:a:python:pillow::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.42%

Probability of exploitation in next 30 days

EPSS Percentile

34.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0042 is in the 13th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference

View patch

pippatch availablevia ghsa

Product: pillowFixed in: 12.3.0

Vendor Advisories (1)

pipGHSA-5x94-69rx-g8h2high

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Jul 20, 2026

References

github.com / python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst

Release Notes

github.com / python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d

Patch

github.com / python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2

ExploitVendor Advisory