FITS GZIP decompression bomb in Pillow

CAO 7.5CVE-2026-40192 · BIT-pillow-2026-40192 · GHSA-whj4-6x5x-4v2j · Công bố 15/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-40192 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng pillow, pillow (python).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.67%, cao hơn 52.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 12.2.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
pillow PyPI	`≥ 10.3.0, < 12.2.0`	`12.2.0`
pillow python	`≥ 10.3.0, < 12.2.0`	`12.2.0`

Mô tả

Impact

Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Patches

The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).

Workarounds

Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.

Mô tả của NVD

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.