CVE-2026-112892

Name of the Vulnerable Software and Affected Versions Pillow versions 4.1.0 through 12.11.0

Description The MSP RLE decoder in the Pillow imaging library allows a small file to expand into an unbounded in-memory buffer. This occurs because the decoder writes run-length output to BytesIO without limiting the expansion to the declared image size. An attacker can provide a specially crafted MSP image to an application that loads its pixels, leading to memory exhaustion and a denial of service, even if the declared pixel count passes the decompression-bomb check (a security mechanism designed to prevent resource exhaustion from overly large images).

Recommendations Update to version 13.0.0.