CyberRota Analysis
AI-GeneratedPillow, a widely used Python imaging library, is vulnerable to excessive memory allocation due to improper handling of dimensions from BDF font files, which can lead to denial-of-service conditions. This vulnerability allows attackers to bypass Pillow's decompression bomb protection, potentially exhausting system resources. Users of Pillow prior to version 12.3.0 should prioritize upgrading to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)