CVE-2026-40192
Pillow is vulnerable to a FITS GZIP decompression bomb
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
| CWE | CWE-770 CWE-400 |
| Vendor | python-pillow |
| Product | pillow |
| Published | Apr 15, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for python-pillow pillow
Be the first to know when new high vulnerabilities affecting python-pillow pillow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
python-pillow / Pillow
>= 10.3.0, < 12.2.0
References
github.com: https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j github.com: https://github.com/python-pillow/Pillow/pull/9521 github.com: https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 pillow.readthedocs.io: https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-40192 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2458856 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24761 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27076 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24762 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34366 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34368 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34365 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16008 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16030 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16009 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16174 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24866 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17611 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17609 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24977 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19712 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37275 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22629 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21017 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24853 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19375 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22465 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22840 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23361