Skip to main content

Python Pillow CVE-2026-55380

| EUVDEUVD-2026-41901 HIGH
Memory Allocation with Excessive Size Value (CWE-789)
2026-07-06 GitHub_M GHSA-phj9-mv4w-65pm PYSEC-2026-2256
Python Information Disclosure Red Hat Pillow Suse Python Pillow
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft .gd file with oversized header dimensions
  2. Delivery
    Submit file to app that decodes images
  3. Exploit
    GdImageFile._open() reads unchecked _size
  4. Execution
    Trigger excessive C-heap allocation
  5. Impact
    Exhaust memory and crash service

Vulnerability Assessment

Weakness
CWE
CWE-789
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
Exploitation Conditions

Exploitation requires that the target application actually loads and decodes an attacker-supplied file in the libgd 'GD' 2.x format through Pillow's GdImageFile plugin (e.g. via Image.open on untrusted input), and the crafted .gd header must declare oversized width/height to force the excessive allocation. Limiting factors: the GD image format is uncommon, so the application must accept or auto-detect .gd input for the path to be reachable; the impact is confined to availability (memory exhaustion / crash) with no code execution or data disclosure; and a lowered MAX_IMAGE_PIXELS or a format allowlist prevents the trigger. Per CVSS PR:N/UI:N, this is unauthenticated with no user interaction wherever such input is network-reachable.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) reflects a pure availability impact - no confidentiality or integrity loss - which contradicts the source 'Information Disclosure' tag; treat that tag as mislabeled, since the code path only causes excessive allocation, not data leakage. The network vector (AV:N) is realistic only where an application ingests attacker-supplied images over the network AND decodes the .gd format; the underlying trigger is file parsing, so practical exposure depends on whether untrusted .gd input actually reaches Pillow. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability signals are absent; the memory-exhaustion primitive is simple and reliable but yields only DoS, not code execution. Net assessment: a genuine but moderate-priority availability issue - meaningful for services that decode untrusted uploads, low urgency for environments that never process .gd files.
Exploit ScenarioDerived

An attacker uploads a small crafted .gd file whose GD 2.x header declares enormous width and height values to a web service that uses Pillow to open user-submitted images. When the server calls Image.open() on the file, GdImageFile._open() trusts the header dimensions and drives a massive C-heap allocation, exhausting memory and crashing the worker or host. No authentication or user interaction is required beyond getting the file decoded, and no public POC is currently identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 06, 2026

Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger excessive C-heap allocation when opened, because GdImageFile._open() reads image dimensions straight from the GD 2.x header without invoking Pillow's Image._decompression_bomb_check() guard. Any application that loads untrusted .gd files with a vulnerable Pillow version can be crashed or driven into out-of-memory conditions. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 (availability-only impact).

RemediationAI

Vendor-released patch: upgrade Pillow to version 12.3.0 or later, which adds the missing Image._decompression_bomb_check() call to the GD plugin (commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675; advisory GHSA-phj9-mv4w-65pm). If immediate upgrade is not possible, lower PIL.Image.MAX_IMAGE_PIXELS to a conservative value so oversized declared dimensions raise DecompressionBombError before large allocation (trade-off: legitimate very-large images are rejected), and avoid opening untrusted .gd files by restricting accepted formats to an explicit allowlist and refusing GD-format input at the application boundary (trade-off: loss of rarely needed .gd support). Running decode work in a memory-limited, isolated worker (e.g. cgroup or ulimit RLIMIT_AS) contains the blast radius of any residual excessive allocation.

Affected VersionsENISA

Pillow < 12.3.0

Affected Packages

pypi pillow fix: 12.3.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Pillow (the maintained PIL fork) is one of the most widely used Python imaging libraries and ships decoders for many formats, including the libgd 'GD' bitmap format via PIL/GdImageFile.py. Pillow normally defends against decompression-bomb attacks by calling Image._decompression_bomb_check(), which compares declared pixel dimensions against MAX_IMAGE_PIXELS before buffers are allocated. The GD plugin's _open() parsed width/height fields from the GD 2.x header and populated self._size directly, bypassing that check, so an attacker-declared large dimension flowed unchecked into subsequent C-level heap allocation. This is a textbook CWE-789 (Memory Allocation with Excessive Size Value / uncontrolled allocation), in which an untrusted size field governs allocation without validation.

Know when Pillow gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Untrusted .gd input decoded without user interaction gives AV:N/AC:L/PR:N/UI:N; impact is memory-exhaustion DoS only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Patch available
Jul 06, 2026 - 20:02 EUVD

DescriptionCVE.org

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 6,879 pypi packages depend on pillow (1,431 direct, 5,517 indirect)

Ecosystem-wide dependent count for version 12.3.0.

Articles & Coverage 1

News 9 New Python Vulnerabilities - 2 Critical, 7 High, 2 With POC Jul 07, 2026

Executive ViewAI

Why It Matters

Python Pillow image library versions before 12.3.0 are vulnerable to denial-of-service attacks when processing specially crafted GD-format image files, causing uncontrolled memory allocation and application crashes. Any organization using Pillow to load untrusted images faces immediate risk of service outages. This availability-impacting vulnerability requires rapid detection and containment while the vendor develops a permanent patch.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable GD image format support if operationally feasible; (2) Enforce strict file-type whitelisting rejecting .gd files; (3) Require image files to originate from authenticated, trusted sources only; (4) Implement memory limits and resource monitoring on image processing services; (5) Subscribe to Pillow official security feed for patch notification.

Threat Intelligence Overview

EPSS Score
0.3%
Top 74% exploitable
Prevalence
High
Pillow is a core, extremely widely deployed Python imaging library
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Pillow

View all
CVE-2022-30595 CRITICAL POC
9.8 May 25

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
CVE-2026-59204 HIGH POC
8.7 Jul 14

Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
CVE-2026-54058 HIGH POC
8.3 Jul 14

Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
CVE-2026-59197 HIGH POC
8.2 Jul 14

Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
CVE-2026-59200 HIGH POC
7.5 Jul 14

Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
CVE-2021-23437 HIGH POC
7.5 Sep 03

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb

CVE-2025-48379 HIGH POC
7.1 Jul 01

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a

CVE-2016-4009 CRITICAL
9.8 Apr 13

Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
CVE-2014-3007 CRITICAL
10.0 Apr 27

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
CVE-2026-96639 CRITICAL
9.8 Oct 21

Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
CVE-2021-34552 CRITICAL
9.8 Jul 13

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters

CVE-2021-25289 CRITICAL
9.8 Mar 19

An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-91752 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:39127 ADVISORY https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-55380 ADVISORY https://vuldb.com/vuln/376496 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22626/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2875/ REF https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst REF https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675 REF https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy