ALAS2-2026-3816

Amazon Linux 2 Security Advisory: ALAS2-2026-3816
Advisory Released Date: 2026-07-20
Advisory Updated Date: 2026-07-20
Severity: Important
Issue Overview:

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0. (CVE-2026-54059)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0. (CVE-2026-54060)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0. (CVE-2026-55379)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0. (CVE-2026-55380)


Affected Packages:

python-pillow


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update python-pillow or yum update --advisory ALAS2-2026-3816 to update your system.

New Packages:
aarch64:
    python-pillow-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64
    python-pillow-devel-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64
    python-pillow-doc-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64
    python-pillow-sane-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64
    python-pillow-tk-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64
    python-pillow-debuginfo-2.0.0-23.gitd1c6db8.amzn2.0.19.aarch64

i686:
    python-pillow-2.0.0-23.gitd1c6db8.amzn2.0.19.i686
    python-pillow-devel-2.0.0-23.gitd1c6db8.amzn2.0.19.i686
    python-pillow-doc-2.0.0-23.gitd1c6db8.amzn2.0.19.i686
    python-pillow-sane-2.0.0-23.gitd1c6db8.amzn2.0.19.i686
    python-pillow-tk-2.0.0-23.gitd1c6db8.amzn2.0.19.i686
    python-pillow-debuginfo-2.0.0-23.gitd1c6db8.amzn2.0.19.i686

src:
    python-pillow-2.0.0-23.gitd1c6db8.amzn2.0.19.src

x86_64:
    python-pillow-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64
    python-pillow-devel-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64
    python-pillow-doc-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64
    python-pillow-sane-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64
    python-pillow-tk-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64
    python-pillow-debuginfo-2.0.0-23.gitd1c6db8.amzn2.0.19.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380

Mitre: CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380