Resource exhaustion in Python Pillow
CVE-2026-40192
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.009 (57.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 57.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.009 · change: +0.002
Affected products
- Python Pillow
- Python-Pillow Pillow — versions >= 10.3.0, < 12.2.0
Weakness classification (CWE)
References
- github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j (Patch, Mitigation, Vendor Advisory)
- github.com/python-pillow/Pillow/pull/9521 (Patch, Issue Tracking)
- github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 (Patch)
- pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html (Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-40192?
- CVE-2026-40192 is a high-severity vulnerability in Python Pillow, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-04-15.
- How severe is CVE-2026-40192?
- High severity. CVSS v3 base score is 7.5 out of 10.