Pillow 12.0.0 causes Decompression Bomb Error
Author: cakedanCreated Dec 10, 2025Updated Dec 10, 2025
This code below creates this error: Image size (34746656784 pixels) exceeds limit of 178956970 pixels, could be decompression bomb DOS attack. when using Pillow 12.0.0. Looks to be erroring when trying to get the max font size allowed automatically. Sending in your own max font size causes it to render but missing a lot of letters, e.g. each word comes out to be only one letter.
wc = WordCloud().generate('\n'.join(['test', 'one', 'two']))Traceback (most recent call last):
File "PIL/ImageDraw.py", line 605, in draw_text
mask, offset = image_text.font.getmask2( # type: ignore[union-attr,misc]
AttributeError: 'TransposedFont' object has no attribute 'getmask2'
Traceback (most recent call last):
File "/api/utilities/media/manipulation/i/wordcloud.py", line 42, in wordcloud_buffer
).generate(' '.join(words))
File "wordcloud/wordcloud.py", line 642, in generate
return self.generate_from_text(text)
File "wordcloud/wordcloud.py", line 624, in generate_from_text
self.generate_from_frequencies(words)
File "wordcloud/wordcloud.py", line 453, in generate_from_frequencies
self.generate_from_frequencies(dict(frequencies[:2]),
File "wordcloud/wordcloud.py", line 535, in generate_from_frequencies
draw.text((y, x), word, fill="white", font=transposed_font)
File "PIL/ImageDraw.py", line 661, in text
draw_text(ink)
File "PIL/ImageDraw.py", line 622, in draw_text
mask = image_text.font.getmask( # type: ignore[misc]
File "PIL/ImageFont.py", line 737, in getmask
im = self.font.getmask(text, mode, *args, **kwargs)
File "PIL/ImageFont.py", line 522, in getmask
return self.getmask2(
File "PIL/ImageFont.py", line 625, in getmask2
return self.font.render(
File "PIL/ImageFont.py", line 622, in fill
Image._decompression_bomb_check(size)
File "PIL/Image.py", line 3429, in _decompression_bomb_check
raise DecompressionBombError(msg)
DecompressionBombError: Image size (5702616620 pixels) exceeds limit of 178956970 pixels, could be decompression bomb DOS attack.Source: amueller/word_cloud