Security update for python-Pillow
This update for python-Pillow fixes the following issues - CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409). - CVE-2026-54060: a font can trigger excessive allocation during conversion or saving (bsc#1270410). - CVE-2026-55379: bypass of decompression bomb protection, allowing excessive memory allocation (bsc#1270411). - CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-Pillow fixes the following issues - CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409). - CVE-2026-54060: a font can trigger excessive allocation during conversion or saving (bsc#1270410). - CVE-2026-55379: bypass of decompression bomb protection, allowing excessive memory allocation (bsc#1270411). - CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1270409
- https://bugzilla.suse.com/1270410
- https://bugzilla.suse.com/1270411
- https://bugzilla.suse.com/1270412
- https://www.suse.com/security/cve/CVE-2026-54059
- https://www.suse.com/security/cve/CVE-2026-54060
- https://www.suse.com/security/cve/CVE-2026-55379
- https://www.suse.com/security/cve/CVE-2026-55380
- https://www.suse.com/support/update/announcement/2026/suse-su-20262875-1/