An update for python-pillow is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3138 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 python-pillow security update An update for python-pillow is now available for openEuler-22.03-LTS-SP4 Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816) Security Fix(es): Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059) Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060) Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379) Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380) Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.(CVE-2026-59197) Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.(CVE-2026-59200) Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204) An update for python-pillow is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-pillow https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-54059 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-54060 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-55379 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-55380 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59197 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59200 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59204 https://nvd.nist.gov/vuln/detail/CVE-2026-54059 https://nvd.nist.gov/vuln/detail/CVE-2026-54060 https://nvd.nist.gov/vuln/detail/CVE-2026-55379 https://nvd.nist.gov/vuln/detail/CVE-2026-55380 https://nvd.nist.gov/vuln/detail/CVE-2026-59197 https://nvd.nist.gov/vuln/detail/CVE-2026-59200 https://nvd.nist.gov/vuln/detail/CVE-2026-59204 openEuler-22.03-LTS-SP4 python-pillow-9.0.1-12.oe2203sp4.src.rpm python-pillow-debuginfo-9.0.1-12.oe2203sp4.aarch64.rpm python-pillow-debugsource-9.0.1-12.oe2203sp4.aarch64.rpm python3-pillow-9.0.1-12.oe2203sp4.aarch64.rpm python3-pillow-devel-9.0.1-12.oe2203sp4.aarch64.rpm python3-pillow-qt-9.0.1-12.oe2203sp4.aarch64.rpm python3-pillow-tk-9.0.1-12.oe2203sp4.aarch64.rpm python-pillow-debuginfo-9.0.1-12.oe2203sp4.x86_64.rpm python-pillow-debugsource-9.0.1-12.oe2203sp4.x86_64.rpm python3-pillow-9.0.1-12.oe2203sp4.x86_64.rpm python3-pillow-devel-9.0.1-12.oe2203sp4.x86_64.rpm python3-pillow-qt-9.0.1-12.oe2203sp4.x86_64.rpm python3-pillow-tk-9.0.1-12.oe2203sp4.x86_64.rpm python3-pillow-help-9.0.1-12.oe2203sp4.noarch.rpm Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-54059 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-54060 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-55379 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-55380 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-59197 openEuler-22.03-LTS-SP4 High 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-59200 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138 Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0. 2026-07-24 CVE-2026-59204 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pillow security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138