CVE-2026-112901

Received Received - Intake

Regular Expression Denial of Service in Pillow

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112901

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	< 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. Prior to version 13.0.0, its XBM header parser is vulnerable to regular-expression denial of service. When an application opens a small crafted XBM file, Pillow applies a backtracking expression to the attacker-controlled header before checking image dimensions, causing the process to stall for minutes and denying service.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Pillow. Run 'pip show Pillow' or 'pip list' to verify if the version is below 13.0.0. If so, the system is vulnerable.

Impact Analysis

This vulnerability can cause applications using Pillow to become unresponsive or crash when processing malicious XBM files. It may lead to denial of service, disrupting services that rely on image processing.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately using 'pip install --upgrade Pillow'. Avoid processing untrusted XBM files until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-112901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70