CVE-2026-40192

EUVD-2026-23130

15.04.2026, 23:16

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Affected Products (NVD)

Vendor	Product	Version
python	pillow	10.3.0 ≤ 𝑥 < 12.2.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

pillow

bookworm	9.4.0-1.1+deb12u1 fixed
bookworm (security)	9.4.0-1.1+deb12u1 fixed
bullseye	8.1.2+dfsg-0.3+deb11u2 fixed
bullseye (security)	8.1.2+dfsg-0.3+deb11u3 fixed
forky	12.2.0-1 fixed
sid	12.2.0-1 fixed
trixie	11.1.0-5+deb13u2 fixed
trixie (security)	11.1.0-5+deb13u2 fixed

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628

https://github.com/python-pillow/Pillow/pull/9521

https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb