CVE-2023-44271: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

Affected products

• Fedoraproject Fedora: version 38 only
• Python Pillow: before 10.0.0 (fixed in 10.0.0)

Published 2023-11-03. Last modified 2026-06-17.