8.7
High
CVE-2026-40192 Pillow is a Python imaging library
Description
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pillow 10.3 | 10.3.0 → < 12.2.0 | 12.2.0 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions not published | |
| Red Hat AI Inference Server 3.3 1778244546 | earliest → < 1778244546 | 1778244546 |
| Red Hat Ansible Automation Platform 2.6 1780102732 | earliest → < 1780102732 | 1780102732 |
| Red Hat Enterprise Linux AI 3.3 1778666124 | earliest → < 1778666124 | 1778666124 |
Show the 24 other branches Hide the 24 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI 2.25 1786711151 | earliest → < 1786711151 | 1786711151 |
| Red Hat OpenShift AI 3.3 1782471606 | earliest → < 1782471606 | 1782471606 |
| Red Hat Quay 3.12 1779811412 | earliest → < 1779811412 | 1779811412 |
| Red Hat Quay 3.14 1779689392 | earliest → < 1779689392 | 1779689392 |
| Red Hat Quay 3.15 1780891395 | earliest → < 1780891395 | 1780891395 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.17 1779922205 | earliest → < 1779922205 | 1779922205 |
| Red Hat Quay 3.1 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Quay 3.9 1779811473 | earliest → < 1779811473 | 1779811473 |
| Lightspeed Core | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Quay 3.10 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Satellite 6.17 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.18 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.19 for RHEL 9 | Versions not published | |
| Red Hat AI Inference Server 3.4 1787151840 | earliest → < 1787151840 | 1787151840 |
| Red Hat AI Inference Server 3.2 1787884873 | earliest → < 1787884873 | 1787884873 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- pillow.readthedocs.io pillow.readthedocs.io
Timeline
- Published
- Last modified
Other CVEs of Pillow
The 60 CVEs of Pillow →
CVE-2026-112902
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
8.3
High
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
6.3
Medium
CVE-2026-114501
Pillow is a Python imaging library
6.3
Medium
CVE-2026-96639
Pillow is a Python imaging library
9.8
Critical