Live › vulnerability › CVE-2026-112892
Go to dashboardPillow's MSP image decoder expands run-length data into memory without a cap tied to the declared image size, so a tiny crafted MSP file can force hundreds of megabytes of allocation. An attacker who can get an application to open such a file can exhaust its memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pillow | pypi | >= 4.1.0, < 13.0.0 | 13.0.0 |
pip show pillow and check whether the version is below 13.0.013.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.
The MSP decoder writes each run into an unbounded io.BytesIO and can expand roughly 85x per run:
src/PIL/MspImagePlugin.py:144-146Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so MAX_IMAGE_PIXELS does not bound it.
This page as .md · .json · in your agent: get_signal("CVE-2026-112892")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.