{"id":"CVE-2026-112892","aliases":["GHSA-gg2r-wvfm-q9rx"],"url":"https://o3.security/vulnerability/CVE-2026-112892","summary":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","details":"### Summary\nThe MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.\n\n### Details\nThe MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:\n\n- `src/PIL/MspImagePlugin.py:144-146`\n\n### Impact\nMemory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.","published":"2026-10-19T21:35:25.797Z","modified":"2026-10-24T02:48:20.090745709Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"pillow","fixedVersion":"13.0.0"}],"fix":{"url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3","label":"python-pillow/Pillow@5dcb630"},"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112892.json"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:20.090745709Z"}}