CVE-2026-40192

high

Description

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb

https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j

https://github.com/python-pillow/Pillow/pull/9521

https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628

https://bugzilla.redhat.com/show_bug.cgi?id=2458856

https://access.redhat.com/security/cve/CVE-2026-40192

https://access.redhat.com/errata/RHSA-2026:37275

https://access.redhat.com/errata/RHSA-2026:34368

https://access.redhat.com/errata/RHSA-2026:34366

https://access.redhat.com/errata/RHSA-2026:34365

https://access.redhat.com/errata/RHSA-2026:27076

https://access.redhat.com/errata/RHSA-2026:24977

https://access.redhat.com/errata/RHSA-2026:24866

https://access.redhat.com/errata/RHSA-2026:24853

https://access.redhat.com/errata/RHSA-2026:24762

https://access.redhat.com/errata/RHSA-2026:24761

https://access.redhat.com/errata/RHSA-2026:23361

https://access.redhat.com/errata/RHSA-2026:22840

https://access.redhat.com/errata/RHSA-2026:22629

https://access.redhat.com/errata/RHSA-2026:22465

https://access.redhat.com/errata/RHSA-2026:21017

https://access.redhat.com/errata/RHSA-2026:19712

https://access.redhat.com/errata/RHSA-2026:19375

https://access.redhat.com/errata/RHSA-2026:17611

https://access.redhat.com/errata/RHSA-2026:17609

https://access.redhat.com/errata/RHSA-2026:16174

https://access.redhat.com/errata/RHSA-2026:16030

https://access.redhat.com/errata/RHSA-2026:16009

https://access.redhat.com/errata/RHSA-2026:16008

Details

Source: Mitre, NVD

Published: 2026-04-15

Updated: 2026-07-10

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00042