Ubuntu patches multiple Pillow vulnerabilities including RCE and DoS risks

Ubuntu has issued security notice USN-8999-1 to address a series of vulnerabilities discovered in the Pillow Python Imaging Library. These flaws affect multiple Ubuntu Long Term Support (LTS) releases, including 22.04 LTS, 24.04 LTS, and 26.04 LTS. The vulnerabilities primarily involve improper handling of various image and font file formats, which could be exploited by malicious actors.

The security issues include risks of denial of service (DoS) through decompression bombs in font, GD, and PDF files, as well as more severe flaws that could lead to arbitrary code execution or sensitive information disclosure. Users are advised to update their python3-pil packages to the patched versions provided by the Ubuntu security team to mitigate these risks.

Technical breakdown of Pillow vulnerabilities

• Arbitrary Code Execution: Flaws in the rank filter implementation (CVE-2026-59197) and color management transforms (CVE-2026-59205) involve incorrect validation of filter sizes and image mode compatibility, potentially allowing attackers to execute arbitrary code or crash the system.
• Denial of Service (DoS): Multiple vulnerabilities (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59200, CVE-2026-59204) stem from a lack of decompression bomb checks in font files, GD images, PDF streams, and JPEG2000 tiles, leading to excessive memory consumption.
• Information Disclosure: Improper handling of map stride values when loading McIdas AREA images (CVE-2026-54058) could allow an attacker to obtain sensitive information.
• Logic and Parsing Errors: Issues include incorrect image coordinate calculations (CVE-2026-59199), negative byte counts in EPS BeginBinary directives (CVE-2026-59203, affecting only 26.04 LTS), and incorrect accumulation of JPEG2000 tile component widths.

Why it matters

Because Pillow is a fundamental library for image processing in Python, these vulnerabilities impact any Linux-based application, web server, or automated pipeline that processes untrusted user-uploaded images or fonts. System administrators and developers using Ubuntu LTS distributions should prioritize these updates to prevent memory exhaustion or remote code execution in their environments.