{"id":"CVE-2026-112892","title":"pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)","summary":"A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decom…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-409","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","openshift_lightspeed","ai_inference_server","ansible_automation_platform 2","enterprise_linux 8","enterprise_linux_ai_rhel_ai 3","lightspeed_services_for_ocp","openshift_ai_rhoai","quay 3","satellite 6"],"patched":["pillow 13.0.0"],"published":"2026-10-19","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:02:57+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112892"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559393"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112892"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892"},{"url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3"},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx"}],"tags":["csaf","vex","red-hat","osv","pip","cve.org","ghsa"],"epss":0.00417,"epssPercentile":0.35873,"aliases":["GHSA-gg2r-wvfm-q9rx","BIT-pillow-2026-112892"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-22T21:11:15.830778Z"},"scores":{"vendor":7.5,"cna":8.7},"ingestedAt":"2026-10-19T21:43:56.112Z","slug":"CVE-2026-112892","body":"## Overview\n\nA flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding (RLE) decoder expands image data into an unbounded memory buffer, resulting in memory exhaustion and application crashes.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json)\n\n**pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-26.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Lightspeed Services for OCP\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n- Red Hat Satellite 6\n\nNo fix planned:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Lightspeed Services for OCP\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Quay 3\n- Red Hat Satellite 6\n\nNot affected:\n\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-112892)\n\nAffected packages:\n\n- `pillow >= 4.1.0, < 13.0.0`\n\nPatched in:\n\n- `pillow 13.0.0`\n\nSource: https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":228114,"id":"CVE-2026-112892","ts":1792758097040,"field":"cvss","old":"8.7","new":"7.5"}]}