Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

SUSE Python-Pillow Important Security Fix Advisory 2026-3268-1

suse
Calendar Grey July 27, 2026
Scroller Suse
SUSE released an important update for python-Pillow addressing 11 vulnerabilities, with detailed patch instructions for installation.
SUSE has released a security update for python-Pillow that addresses 11 vulnerabilities

Summary

## This update for python-Pillow fixes the following issues: * CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on `mmap` path (bsc#1271419). * CVE-2026-54059: bomb protection bypass via PCF font loading due to `Image.frombytes()` being called without `_decompression_bomb_check()` (bsc#1270409). * CVE-2026-54060: excessive allocation due to `FontFile.compile()`: `Image.new()` being called without `_decompression_bomb_check()` (bsc#1270410). * CVE-2026-55379: bomb protection bypass via font loading due to `Image.new()` being called without `_decompression_bomb_check()` (bsc#1270411). * CVE-2026-55380: unchecked 4.3 GB C-heap allocation due to image dimensions being accepted without `_decompression_bomb_check()` in `GdImageFile._open()` (bsc#1270412).

Topics%20covered

Topics Covered

security advisory update vulnerability important SUSE Linux Enterprise python-pillow

References

* bsc#1270409

* bsc#1270410

* bsc#1270411

* bsc#1270412

* bsc#1271418

* bsc#1271419

* bsc#1271420

* bsc#1271421

* bsc#1271422

* bsc#1271424

* bsc#1271425

Cross-

* CVE-2026-54058

* CVE-2026-54059

* CVE-2026-54060

* CVE-2026-55379

* CVE-2026-55380

* CVE-2026-59197

* CVE-2026-59198

* CVE-2026-59199

* CVE-2026-59200

* CVE-2026-59204

* CVE-2026-59205

CVSS scores:

* CVE-2026-54058 ( SUSE ): 5.9

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-54058 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

* CVE-2026-54058 ( NVD ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:3268-1
Release Date: 2026-07-27T10:59:26Z
Rating: important

Topics%20covered

Topics Covered

security advisory update vulnerability important SUSE Linux Enterprise python-pillow

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.