VulnSocial

CVE-2023-44271Disclosure(fedoraproject / fedora)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

fedoraproject CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fedora
  • pillow

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
fedoraprojectpython
Products
fedorapillow

1 version affected across 2 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-11: 104-11
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Veros@boldnames
    Disclosure

    Don't just take my word for it, verify. We scanned a trending public Github repository by @Microsoft at microsoft/markitdown and found 2 critical OSVs interlinked to 6 CVEs, among other findings: https://github.com/microsoft/markitdown Dependencies: Pillow>=9.0.0 -> CVE-2023-50447, CVE-2024-28219, CVE-2023-44271. mcp~=1.8.0 -> CVE-2025-53366, CVE-2025-66416, CVE-2025-53365. Per this post, the dependency still exist at > >markitdown-ocr/pyproject.toml >markitdown-mcp/pyproject.toml

    Post summary

    The post reports discovery of multiple CVEs linked to a GitHub repository, focusing on vulnerability disclosure without providing PoC, exploit, or mitigation details.

    10100263
    4.6K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
OSfedoraprojectfedora38--
Apppythonpillow---

Explore more

Back to dashboardfedoraproject CVEspython CVEsfedora vulnerabilities