In breve
- CVE-2026-40192 è una vulnerabilità ALTO (CVSS 7.5) che riguarda pillow, pillow (python).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.67%, superiore al 52.0% delle vulnerabilità.
- Correzione: aggiornare a 12.2.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| pillow PyPI | ≥ 10.3.0, < 12.2.0
| 12.2.0
|
| pillow | ≥ 10.3.0, < 12.2.0
| 12.2.0
|
Description
Impact
Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).
Patches
The amount of data read is now limited to the necessary amount.
Fixed in Pillow 12.2.0 (PR #9521).
Workarounds
Avoid Pillow >= 10.3.0, < 12.2.0
Only open specific image formats, excluding FITS.
NVD description
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free