GdImageFile.open accepts any dimensions without the bomb check
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
- Advisory
- CVE-2026-55380
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 7.5 out of 10, as published
- Affected
- < 12.3.0
- Fixed in
- 12.3.0
- Reaches you
- through another call
What triggers it
Calling PIL.GdImageFile.open directly on a GD 2.x file.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A GD file is not one of the four formats a scan can be; the check does not know it and refuses it as unknown. It is reached only by calling GdImageFile.open by name, which Image.open never does.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 12.3.0.
Specifically. Refuse what is not an image a scan can be, as sillybos does by default; GdImageFile.open is a direct call that bypasses Image.open's registry.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-phj9-mv4w-65pm
- https://osv.dev/vulnerability/PYSEC-2026-2256
- The record entry, triaged 2026-11-03, last checked 2026-11-03