{"id":"CVE-2026-112892","kind":"vulnerability","aliases":["CVE-2026-112892","GHSA-gg2r-wvfm-q9rx"],"related":[],"title":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","description":"### Summary\nThe MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.\n\n### Details\nThe MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:\n\n- `src/PIL/MspImagePlugin.py:144-146`\n\n### Impact\nMemory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.","summary":"Pillow's MSP image decoder expands run-length data into memory without a cap tied to the declared image size, so a tiny crafted MSP file can force hundreds of megabytes of allocation. An attacker who can get an application to open such a file can exhaust its memory and cause a denial of service.","severity":"high","cvss":8.7,"epss":0.0029100000392645597,"exploited":false,"exploited_at":null,"products":[{"name":"pillow","fixed":["13.0.0"],"affected":">= 4.1.0, < 13.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-409","image-upload","package","pillow","python","self-hosted"],"not_affected_if":["msp-format-not-used","no-untrusted-image-input","pillow-13-or-later"],"how_to_check":"Run pip show pillow and check whether the version is below 13.0.0.\nFind apps that open untrusted images with PIL.Image.open and then load pixels (e.g. .load(), .convert(), .tobytes()).","fix":"Upgrade pillow to 13.0.0 or later.\nIf upgrading is not possible, reject or do not load MSP files from untrusted sources.","status":"open","published_at":"2026-10-19T22:17:09+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:10:10+00:00","updated_at":"2026-10-23T21:57:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:10:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade pillow to 13.0.0 or later.\nIf upgrading is not possible, reject or do not load MSP files from untrusted sources.","summary":"Pillow's MSP image decoder expands run-length data into memory without a cap tied to the declared image size, so a tiny crafted MSP file can force hundreds of megabytes of allocation. An attacker who can get an application to open such a file can exhaust its memory and cause a denial of service.","category":"package","who_cares":["python","pillow","image-upload","self-hosted"],"confidence":0.8,"analyst_note":"","how_to_check":"Run pip show pillow and check whether the version is below 13.0.0.\nFind apps that open untrusted images with PIL.Image.open and then load pixels (e.g. .load(), .convert(), .tobytes()).\nunknown","needs_analyst":false,"not_affected_if":["pillow-13-or-later","no-untrusted-image-input","msp-format-not-used"],"severity_if_unknown":"unknown"},"cost_usd":0.000396,"input_tokens":2197,"output_tokens":353,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112892':14A,22A '-146':160C '-2026':13A,21A '-409':25B '144':159C '85x':155C 'alloc':68B,134C 'applic':75B,137C,175C 'attack':70B 'bound':194C 'buffer':106C 'cap':49B,109C 'caus':86B 'check':125C 'count':124C,187C 'craft':59B,171C 'cve':12A,20A 'cwe':24B 'data':44B,100C 'declar':53B,113C,185C 'decod':4A,39B,95C,143C 'decoupl':182C 'denial':88B,165C 'detail':140C 'exhaust':82B,164C 'expand':5A,40B,96C,153C 'expans':180C 'file':8A,61B,80B,118C 'forc':63B,127C 'get':73B 'gg2r':17A 'ghsa':16A 'ghsa-gg2r-wvfm-q9rx':15A 'host':34B 'hundr':64B,128C 'imag':27B,38B,54B,114C,172C,190C 'image-upload':26B 'impact':161C 'in-memori':103C 'io.bytesio':150C 'length':43B,99C 'load':138C,177C 'max':189C 'megabyt':66B,130C 'memori':11A,46B,84B,105C,163C 'memory-exhaust':162C 'msp':2A,37B,60B,93C,142C 'open':77B 'packag':29B 'pass':120C 'per':156C 'pillow':1A,23A,30B,35B 'pixel':123C,139C,178C,186C,191C 'pixel-count':122C 'python':31B 'q9rx':19A 'rle':3A,94C 'rough':154C 'run':42B,98C,146C,157C 'run-length':41B,97C 'self':33B 'self-host':32B 'servic':90B,167C 'size':55B,115C 'small':117C 'src/pil/mspimageplugin.py':158C 'summari':91C 'tie':50B,110C 'tini':7A,58B,170C 'unbound':10A,149C 'upload':28B 'without':47B 'write':144C 'wvfm':18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gg2r-wvfm-q9rx","url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","severity":"high","published_at":"2026-10-21T21:12:56+00:00","modified_at":"2026-10-21T21:12:57+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892","severity":null,"published_at":"2026-10-19T22:17:09+00:00","modified_at":"2026-10-22T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}