Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by GitHub_M

CVE-2026-40192Pillow is vulnerable to a FITS GZIP decompression bomb

High 7.5

In plain English

A high-severity resource allocation without limits in Pillow from python-pillow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13pillow11.1.0-5+deb13u2DEBIAN-CVE-2026-40192
Debian:14pillow12.2.0-1DEBIAN-CVE-2026-40192
PyPIpillow12.2.0GHSA-whj4-6x5x-4v2j
PyPIpillow12.2.0PYSEC-2026-2250
Ubuntu:25.10pillow11.3.0-1ubuntu1.2UBUNTU-CVE-2026-40192
Ubuntu:26.04:LTSpillow12.1.1-2ubuntu1.1UBUNTU-CVE-2026-40192

Affected products (as reported)

VendorProductVersions
python-pillow Pillow >= 10.3.0, < 12.2.0

Weakness: CWE-770, CWE-400, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References