CVE-2023-44271

Vulnerability

Description

CVE-2023-44271 is a denial-of-service (DoS) vulnerability in the Pillow Python imaging library, affecting versions before 10.0.0. The issue resides in the truetype font handling within ImageFont, specifically when the textlength method (or related methods like getbbox, getlength, getmask2) of an ImageDraw instance is called with an excessively long text string. The root cause is that the library does not validate the length of the text input before processing, leading to uncontrolled memory allocation that can exhaust available memory and crash the application [1][2][4].

Exploitation and

Attack Vector

An attacker can exploit this vulnerability by providing a very long text string to any Pillow application that uses ImageFont methods such as textlength, getbbox, getlength, or getmask2. No special privileges or authentication are required; the attack vector is over the network if the application accepts user-supplied text (e.g., in a web server, image processing service, or GUI). The vulnerability does not require any prior access, making it remotely exploitable with low complexity [2]. The issue was addressed in Pillow 10.0.0 by introducing a MAX_STRING_LENGTH constant (default 100,000 characters) and a _string_length_check function that raises a ValueError if the input exceeds this limit, preventing unbounded memory allocation [1][3].

Impact

Successful exploitation results in a denial-of-service condition: the Pillow process may consume all available memory and crash, disrupting the service availability for other users. Since the vulnerability is easily triggered by a single long string, it poses a significant risk to applications that process untrusted text input using Pillow's font metrics functions. There is no confidentiality or integrity impact, but the availability impact is high [2].

Mitigation

The vulnerability is fixed in Pillow version 10.0.0 and later. Users should upgrade immediately. No workarounds are available other than upgrading, as the fix introduces input length validation that prevents the memory exhaustion [1][2][3][4].