Pillow CVE-2026-112901

Exploitation requires that the target application pass attacker-controlled data to Pillow's Image.open() (or directly invoke XbmImageFile) on content that is parsed as XBM, meaning the service must accept and attempt to decode untrusted image uploads; the malicious input is a small XBM file whose header contains repeated whitespace/characters that trigger catastrophic backtracking before image dimensions are validated. The attack needs no authentication, no user interaction, and works against default Pillow behavior in affected versions (< 13.0.0). Limiting factors: impact is restricted to stalling the processing worker (availability degradation, no code execution or data access), the application must actually route the file through Pillow's XBM parser, and upgrading to Pillow 13.0.0 - which replaces the regex with line-based parsing - fully remediates it.

This is a real but bounded-severity denial-of-service issue, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, and the impact is confined to availability (VA:L) with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with a CWE-1333 regex denial-of-service that stalls a single worker rather than crashing the host. The vendor-assigned score of 6.9 (Medium) is reasonable; the network vector inflates it, but the real-world impact is a per-request worker stall, not RCE or data exposure. No EPSS score, KEV listing, or POC flag is provided in the input, so there is no signal of active or imminent widespread exploitation. The fix commit does include a regression test (test_redos) containing a concrete reproducing input, which lowers the effort to weaponize, but this is a disclosed-fix reproducer, not evidence of exploitation. Net: a legitimate availability bug worth patching for services that ingest untrusted XBM images, but it does not warrant emergency prioritization over higher-impact flaws. Missing EPSS/KEV data should be verified against CISA KEV and FIRST EPSS before final triage.

An attacker uploads a small, specially crafted XBM image file to a web service or pipeline that uses Pillow to process user-supplied images. When the application calls Image.open() on the file, the XBM header parser applies a backtracking regular expression to the attacker-controlled header, causing CPU to spin and stalling the worker for minutes. No public weaponized exploit is identified, but the fix commit publishes a reproducing test input that demonstrates the trigger.