---
id: CVE-2026-112892
title: >-
  pillow: pillow: Denial of Service via unbounded memory expansion in MSP image
  decoder (CVE-2026-112892)
summary: >-
  A flaw was found in Pillow. A remote attacker can cause a Denial of Service
  (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an
  application that processes image pixels. Due to missing expansion limits
  during decom…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-409
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - exploit_intelligence
  - lightspeed_core
  - openshift_lightspeed
  - ai_inference_server
  - ansible_automation_platform 2
  - enterprise_linux 8
  - enterprise_linux_ai_rhel_ai 3
  - lightspeed_services_for_ocp
  - openshift_ai_rhoai
  - quay 3
  - satellite 6
patched:
  - pillow 13.0.0
published: '2026-10-19'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:02:57+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112892'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559393'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112892'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112892'
  - url: >-
      https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3
  - url: 'https://github.com/python-pillow/Pillow/releases/tag/13.0.0'
  - url: >-
      https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx
  - url: 'https://github.com/python-pillow/Pillow'
  - url: 'https://github.com/advisories/GHSA-gg2r-wvfm-q9rx'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - cve.org
  - ghsa
epss: 0.00417
epssPercentile: 0.35873
aliases:
  - GHSA-gg2r-wvfm-q9rx
  - BIT-pillow-2026-112892
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-22T21:11:15.830778Z'
scores:
  vendor: 7.5
  cna: 8.7
ingestedAt: '2026-10-19T21:43:56.112Z'
---

## Overview

A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding (RLE) decoder expands image data into an unbounded memory buffer, resulting in memory exhaustion and application crashes.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112892.json)

**pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-26.

Affected:

- Exploit Intelligence
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Lightspeed Services for OCP
- Red Hat OpenShift AI (RHOAI)
- Red Hat Quay 3
- Red Hat Satellite 6

No fix planned:

- Exploit Intelligence
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Lightspeed Services for OCP
- Red Hat OpenShift AI (RHOAI)
- Red Hat Quay 3
- Red Hat Satellite 6

Not affected:

- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

## Remediation

Affected

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-112892)

Affected packages:

- `pillow >= 4.1.0, < 13.0.0`

Patched in:

- `pillow 13.0.0`

Source: https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx