Cyber ·
Notice USN-8999-1: flaws in Pillow affecting images, PDFs and fonts
An Ubuntu Security notice describes nine flaws in Pillow, a Python imaging library, with risks of information disclosure, denial of service, crashes or arbitrary code execution when processing files.
Notice USN-8999-1, published by Ubuntu Security on 4 November 2026, covers vulnerabilities in Pillow, a Python library for opening and transforming images. According to the automatic translation of the feed, the flaws may cause information disclosure, denial of service, crashes or arbitrary code execution when processing images and files. The cases listed include incorrectly handled map stride values in McIdas AREA images, decompression bombs in font files and GD images, invalid filter sizes in the rank filter, image coordinate calculations, PDF streams with unlimited decompressed data, EPS files with a negative byte count, JPEG2000 component widths accumulated incorrectly, and colour management mode compatibility. The identifiers are CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204 and CVE-2026-59205. The text states that the EPS flaw affected only Ubuntu 26.04 LTS.
Teams running systems that process images, PDFs or fonts sent by third parties should apply the package update named in the distribution's official notice, restart affected services and limit the size and dimensions of accepted files. To study the case, confirm versions and fixes only in the original notice, and remove personal data and credentials from excerpts before pasting them into AI tools. The original can be consulted on the Ubuntu Security website by searching for the identifier USN-8999-1.