---
id: "CVE-2026-112892"
kind: "vulnerability"
aliases: ["CVE-2026-112892", "GHSA-gg2r-wvfm-q9rx"]
title: "Pillow: MSP RLE decoder expands a tiny file into unbounded memory"
severity: "high"
cvss: 8.7
epss: 0.0029100000392645597
exploited: false
status: "open"
category: "package"
products: [{"name": "pillow", "fixed": ["13.0.0"], "affected": ">= 4.1.0, < 13.0.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-409", "image-upload", "package", "pillow", "python", "self-hosted"]
not_affected_if: ["msp-format-not-used", "no-untrusted-image-input", "pillow-13-or-later"]
published_at: "2026-10-19T22:17:09+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gg2r-wvfm-q9rx", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112892", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Pillow's MSP image decoder expands run-length data into memory without a cap tied to the declared image size, so a tiny crafted MSP file can force hundreds of megabytes of allocation. An attacker who can get an application to open such a file can exhaust its memory and cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pillow affected >= 4.1.0, < 13.0.0 fixed 13.0.0

## How to check

Run pip show pillow and check whether the version is below 13.0.0.
Find apps that open untrusted images with PIL.Image.open and then load pixels (e.g. .load(), .convert(), .tobytes()).

## Fix

Upgrade pillow to 13.0.0 or later.
If upgrading is not possible, reject or do not load MSP files from untrusted sources.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-gg2r-wvfm-q9rx
- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112892

## From the sources

### Summary
The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.

### Details
The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:

- `src/PIL/MspImagePlugin.py:144-146`

### Impact
Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_