USN-8999-1: Ubuntu Patches 11 Vulnerabilities in Pillow, from DoS to Possible RCE

Ubuntu published security advisory USN-8999-1 on 4 November 2026, addressing 11 vulnerabilities in the python3-pil package—that is, Pillow, the Python library for image manipulation. It affects Ubuntu 22.04 LTS (jammy), 24.04 LTS (noble) and 26.04 LTS (resolute).

Pillow is not foreground-facing software: it's the library that many Python backends use to generate thumbnails, resize uploads, add watermarks or convert image formats. Anyone running a CMS with image galleries, an e-commerce platform with product photos or a service accepting user uploads likely has Pillow in the chain, often without knowing it.

What the patch fixes

Most of the flaws are decompression bomb issues—maliciously crafted files designed to trigger uncontrolled memory allocation until process resources are exhausted. The advisory lists:

• CVE-2026-54058: improper stride handling in McIdas AREA images, potentially leading to information disclosure or DoS;
• CVE-2026-54059, CVE-2026-54060, CVE-2026-55379: missing decompression bomb checks when loading fonts;
• CVE-2026-55380: same issue in GD image files;
• CVE-2026-59197: incorrect validation of filter dimensions in the rank filter implementation, potentially causing crashes or arbitrary code execution;
• CVE-2026-59199: incorrect image coordinate calculation, leading to crashes;
• CVE-2026-59200: missing limit on decompressed data size in PDFs;
• CVE-2026-59203: improper parsing of EPS files with negative byte count in the BeginBinary directive, limited to Ubuntu 26.04 LTS;
• CVE-2026-59204: incorrect accumulation of JPEG2000 tile widths;
• CVE-2026-59205: incorrect validation of image mode compatibility in colour management transforms, potentially causing crashes or arbitrary code execution.

On the technical details of CVE-2026-54059, Pillow 12.3.0's official release notes clarify that decompression bomb checks were added to FontFile and its subclasses, verifying character width and height. The underlying bug specifically concerned loading PCF fonts, where data was passed to a conversion function without anti-bomb validation.

How to update

A standard system update (apt update && apt upgrade) applies the fix. The target versions of the python3-pil package are shown in the table.

Ubuntu Release	Code name	Fixed version
22.04 LTS	jammy	9.0.1-1ubuntu0.6
24.04 LTS	noble	10.2.0-1ubuntu1.4
26.04 LTS	resolute	12.1.1-2ubuntu1.4

For Ubuntu Pro users, security coverage for Main and Universe packages extends to ten years, including on up to five machines at no cost.