SB2026072519 - openEuler 22.03 LTS SP4 update for python-pillow
Published: July 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-54059)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in PcfFontFile._load_bitmaps() when parsing a crafted PCF font file. A remote attacker can supply a crafted PCF font with oversized glyph dimensions to cause a denial of service.
The issue occurs because glyph dimensions from the PCF METRICS section are passed to Image.frombytes() without a decompression bomb check before memory allocation.
2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-54060)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in FontFile.compile() in PIL/FontFile.py when assembling glyph images from a crafted BDF or PCF font into a combined bitmap. A remote attacker can supply a specially crafted font file to cause a denial of service.
The issue affects the font loading code path used by BdfFontFile and PcfFontFile, where the standard decompression bomb guard is not invoked before the combined bitmap is created.
3) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-55379)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in the PIL/BdfFontFile.py bdf_char() font loading path when parsing a crafted BDF font file with oversized BBX dimensions and an empty BITMAP section. A remote attacker can supply a specially crafted BDF font file to cause a denial of service.
Loaded glyph images persist in memory for the lifetime of the font object.
4) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-55380)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in GdImageFile._open() and the subsequent image loading path when processing a crafted .gd image through PIL.GdImageFile.open(fp) and calling load(). A remote attacker can supply a specially crafted .gd file with oversized dimensions to cause a denial of service.
A 1037-byte header-only file is sufficient to trigger an attempted allocation of approximately 4.3 GB.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-59197)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to cause a denial of service and overwrite heap memory.
The vulnerability exists due to a heap-based buffer overflow in the ImageFilter.RankFilter API and ImagingExpand function when processing a very large odd filter size through public rank-filter classes. A remote attacker can supply a specially crafted filter size to cause a denial of service and overwrite heap memory.
The issue is reachable through documented public classes including RankFilter, MedianFilter, MinFilter, and MaxFilter. If the image is also attacker-supplied, the out-of-bounds value written past the allocation can be influenced by source image border pixels.
6) Resource exhaustion (CVE-ID: CVE-2026-59200)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in PdfParser.PdfStream.decode() in Pillow's PdfParser.py when parsing a crafted FlateDecode-compressed PDF stream. A remote attacker can submit a specially crafted PDF file to cause a denial of service.
The issue occurs because zlib.decompress() is called with the PDF stream Length or DL value as an initial buffer hint without limiting the actual decompressed output size.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59204)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper memory allocation in the JPEG2000 tiled decoder in src/libImaging/Jpeg2KDecode.c when parsing a crafted tiled JPEG2000 image during decoding. A remote attacker can supply a specially crafted tiled JPEG2000 file to cause a denial of service.
The issue occurs because total_component_width is accumulated across tiles and then used to calculate tile_bytes, which can grow the scratch buffer to roughly the decompressed size of the full image.
8) Path traversal (CVE-ID: CVE-2022-22815)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in path_getbbox() function in path.c. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
9) Out-of-bounds read (CVE-ID: CVE-2022-22816)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to buffer over-read during initialization of ImagePath.Path in path_getbbox() function in path.c. A remote attacker can pass a specially crafted file to the affected library and read contents of memory on the system.
Remediation
Install update from vendor's website.