EUVD-2026-104650
GHSA-gg2r-wvfm-q9rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious MSP RLE image
-
DeliverySubmit image to decoding endpoint
-
ExploitDecoder expands runs past declared size
-
ExecutionUnbounded BytesIO buffer exhausts memory
-
ImpactService denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | The target application must accept and decode attacker-supplied MSP-format images using an affected Pillow version (4.1.0 through 12.x) and must trigger pixel loading (e.g., Image.load(), save/convert, or thumbnailing). No authentication or user interaction is required per PR:N/UI:N. The primary limiting factor is format exposure: MSP is a legacy Microsoft Paint format, so only pipelines that process it (or auto-detect it from content rather than a restrictive allowlist) are exploitable; services that restrict decoding to JPEG/PNG/WebP are not affected despite the network attack vector. The decompression-bomb pixel-count guard does NOT mitigate this, as expansion occurs during RLE decode independent of declared pixel count. |
| Impact | This is a memory-exhaustion denial-of-service in Pillow's MSP RLE decoder (CWE-409, data amplification), where a small crafted file expands into an unbounded in-memory buffer because the decoder does not cap run-length output to the declared image dimensions - notably bypassing Pillow's existing decompression-bomb check. The input CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and VC:N/VI:N confirms a pure availability impact: no confidentiality or integrity loss, reachable remotely with low complexity and no privileges. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, so this is not an active-exploitation priority. The realistic risk is moderate-to-elevated for services that auto-ingest untrusted images (upload/thumbnail/avatar pipelines) but is bounded by a key precondition the CVSS 'network' vector obscures: the target application must actually accept and decode the legacy MSP format, which is uncommon - verify exposure against your own image-handling allowlist. The 8.7 base score reflects easy reachability and total service disruption, not a code-execution or data-breach threat. |
| Exploit ScenarioDerived | An attacker uploads a small, specially crafted MSP image to a web service that uses Pillow to decode or thumbnail user-supplied images. When the application loads the image's pixels, the flawed RLE decoder amplifies the tiny file into a massive in-memory buffer, exhausting RAM and crashing or hanging the worker process. No public exploit is identified, but the fix commit publicly reveals the missing bounds check, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Memory exhaustion denial of service in Pillow 4.1.0 through 12.x allows unauthenticated remote attackers to exhaust server memory when an application decodes a crafted MSP image and loads its pixels. The MSP RLE decoder writes expanded run-length output into an in-memory buffer without limiting it to the declared image dimensions, bypassing Pillow's decompression-bomb pixel-count guard; no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Pillow 13.0.0. Upgrade to Pillow 13.0.0 or later, which caps MSP RLE run expansion to the declared row width as shown in commit 5dcb630b9798efd91929cb873d677aeee6ed0bb3; review the advisory at https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx and release notes at https://github.com/python-pillow/Pillow/releases/tag/13.0.0. If immediate upgrade is not possible, reject MSP-format inputs at the application boundary and enforce a strict allowlist of required image formats (for example JPEG, PNG, and WebP), validating actual decoded content rather than trusting file extensions; this prevents exposure but breaks legitimate MSP workflows. Additionally, run image decoding in a subprocess or container with strict memory limits so a malicious MSP file terminates only the worker rather than the main service; this adds operational complexity and may fail large legitimate images. Do not rely on the decompression-bomb pixel-count check alone, because the RLE expansion occurs independently of the declared pixel count.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pillow's MspImagePlugin implements decoding for MSP, a legacy Microsoft Paint image format that uses run-length encoding. In affected versions, the RLE decoder accumulates output in a BytesIO/bytearray while expanding run counts, but it does not cap the number of bytes produced to the declared image width or total size. This is CWE-409 (improper handling of highly compressed data / data amplification): a tiny crafted file can cause large memory allocation, leading to availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VA:H). The CPE cpe:2.3:a:python-pillow:pillow:*:*:*:*:*:*:*:* maps to the affected Pillow package range before 13.0.0. The upstream fix in commit 5dcb630 caps each run length to the remaining bytes in the current row (self.state.xsize - len(row_data)) before appending to the row buffer, preventing unbounded expansion even when the declared pixel count passes decompression-bomb checks.
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remotely supplied image decoded with no auth or interaction (AV:N/AC:L/PR:N/UI:N); pure memory-exhaustion DoS gives A:H with C:N/I:N and unchanged scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.
Blast Radius
ecosystem impact- 2 pypi packages depend on pillow (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.1.0.
Technical POC Analysis
Bug class: CWE-409 (improper handling of highly compressed data) with the resource-consumption consequence tracked as CWE-400 (uncontrolled resource consumption).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Pillow 4.1.0 through 12.x contains a high-severity memory-exhaustion denial-of-service condition in its MSP image decoder that can degrade or take down applications processing crafted images. Any business unit or customer-facing service that accepts user-supplied images and relies on Pillow is affected, making availability and customer trust the primary concerns rather than data confidentiality. No vendor-released patch has been identified at time of analysis and no public exploit identified at time of analysis, but leadership should prioritize inventory and containment because the library is widely embedded.
No vendor-released patch identified at time of analysis; disable MSP decoding, reject MSP uploads at ingress, restrict accepted image formats, enforce strict memory limits via cgroups or ulimits, run image decoding in a sandboxed low-privilege worker, and monitor for memory exhaustion events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
Exploit-DB