CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library prior to version 12.3.0 is vulnerable to excessive memory allocation due to improper handling of glyph dimensions from crafted PCF font data. This can lead to denial-of-service conditions, impacting applications that rely on this library for image processing. Developers and organizations using Pillow for image manipulation should prioritize updating to version 12.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)