Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them direc…

A vulnerability in the Python Pillow imaging library (prior to version 12.3.0) allows crafted PCF font files to cause excessive memory allocation. The flaw exists in PIL/PcfFontFile.py within the _load_bitmaps() function, which reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without invoking the decompression bomb check (Image._decompression_bomb_check()). This omission enables an attacker to supply a maliciously crafted PCF font file that triggers unbounded memory consumption, potentially leading to denial of service. The vulnerability is classified as a decompression bomb / resource exhaustion issue. It has been patched in Pillow version 12.3.0. Users are advised to upgrade to version 12.3.0 or later to mitigate the risk.