CVE-2026-55380
HIGHPillow GdImageFile decompression bomb protection bypass
Title source: cnaDescription
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm
X_Refsource_Misc x_refsource_misc
https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
X_Refsource_Misc x_refsource_misc
https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
Scores
CVSS v3
7.5
EPSS
0.0036
EPSS Percentile
28.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-789
Status
published
Products (2)
python/pillow
< 12.3.0
python-pillow/Pillow
< 12.3.0
Published
Jul 06, 2026
Tracked Since
Jul 07, 2026