CVE-2026-112892

Received Received - Intake

Memory Exhaustion in Pillow via MSP RLE Decoder

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112892

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 4.1.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

Pillow's MSP RLE decoder, from versions 4.1.0 to 13.0.0, can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can exploit this by providing a crafted MSP image to an application that loads its pixels, causing memory exhaustion and denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of Pillow (4.1.0 to 13.0.0). Run 'pip show Pillow' to check the installed version. If the version is below 13.0.0, the system is vulnerable.

Impact Analysis

This vulnerability can lead to denial of service by exhausting system memory. Applications using affected Pillow versions may crash or become unresponsive when processing malicious MSP images. It poses a risk to availability but does not directly expose data or allow code execution.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately using 'pip install --upgrade Pillow'. If upgrading is not possible, avoid processing untrusted MSP images until the update is applied.

Hi! I’m here to help you understand CVE-2026-112892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70