PT-2026-32580 · Pypi+2 · Pillow+2
CVE-2026-40192
·
Published
2024-03-25
·
Updated
2026-08-17
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Pillow versions 10.3.0 through 12.1.1
Description
Lack of limits on the amount of GZIP-compressed data read when decoding a FITS image allows for decompression bomb attacks. A specially crafted FITS file can cause unbounded memory consumption, resulting in a denial of service through an OOM (Out of Memory) crash or severe performance degradation.
Recommendations
Update to version 12.2.0.
As a temporary workaround, only open specific image formats, excluding FITS.
Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pillow
Red Os
Ubuntu