CVE-2026-112892 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the Pillow Python imaging library, specifically affecting versions from 4.1.0 through 13.0.0, centers on a critical flaw in the MSP RLE (Run-Length Encoded) decoder implementation. This component is responsible for decompressing image data encoded using Microsoft Paint's proprietary run-length encoding format. The core technical deficiency lies in the decoder's failure to enforce strict bounds checking during the expansion of compressed data into memory. When processing an MSP file, the decoder utilizes a BytesIO object as a buffer to store the uncompressed pixel data. However, it does not validate that the size of this expanded output corresponds to or remains within the limits defined by the image header's declared dimensions. This architectural oversight allows for a significant discrepancy between the actual memory consumption and the expected resource usage based on metadata alone.
This flaw enables a classic decompression bomb attack scenario, often categorized under CWE-409 as an issue related to the extraction of files with excessive expansion ratios. An attacker can craft a malicious MSP image file that is extremely small in its compressed form but contains data patterns designed to expand into a massive amount of uncompressed pixel data when processed by the decoder. Because the validation logic relies on the declared image size rather than monitoring the actual growth of the BytesIO buffer during decompression, the application fails to trigger standard anti-bomb safeguards. Consequently, even if the header claims a reasonable number of pixels that would pass initial security checks, the underlying memory allocation proceeds unchecked until system resources are exhausted.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition for any application integrating Pillow and loading MSP images from untrusted sources. By supplying such crafted files, an attacker can cause the target process to consume excessive amounts of RAM, leading to system instability, crashes, or complete service interruption. This type of attack aligns with MITRE ATT&CK technique T1496, Resource Hijacking, where resources are consumed to degrade performance or availability. The risk is particularly acute in web applications or automated processing pipelines that accept user-uploaded images without rigorous pre-validation beyond basic header checks, as the exploit requires no special privileges and can be triggered remotely if the service processes incoming image data.
Mitigation for this vulnerability involves upgrading to Pillow version 13.0.0 or later, where the MSP RLE decoder has been patched to correctly limit expansion to the declared image size. For environments unable to upgrade immediately, defensive coding practices should be implemented to validate image dimensions against expected limits before processing and to monitor memory usage during decompression operations. Additionally, integrating runtime security controls such as resource quotas for individual processes can help contain the impact of any remaining exploitable inputs until a permanent fix is deployed.