CVE-2026-112892CWE-409

CVE-2026-112892

published October 20, 2026

CVSS
8.7
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-10-20T02:17Z
References (3)
https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3 · [email protected]https://github.com/python-pillow/Pillow/releases/tag/13.0.0 · [email protected]https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 21:35Z
    Pillow: MSP RLE decoder expands a tiny file into unbounded memory
    cvelistv5
  • 19 OCT 21:35Z
    Pillow: MSP RLE decoder expands a tiny file into unbounded memory
    cvelistv5