Pillow EPS scale rendering bypasses decompression bomb limit
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 fixed, 11 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Pillow from 2.3.0 before 13.0.0 does not validate scaled image dimensions before rendering EPS files with Ghostscript. Applications that process untrusted EPS or PostScript files with a scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption (CWE-770). The decompression bomb check runs only after rendering, so output can exceed the configured pixel limit.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | Pillow | 2.5.0 to before 13.0.0 | 13.0.0 | Patch available | CNA |
| — | Pillow (PyPI) | 2.3.0 to before 13.0.0 | 13.0.0 | Patch available | GHSA-vx6w-vv9f-6gvg |
- Pillow Vendorpython-pillow Affected 2.5.0 to before 13.0.0 Fixed in 13.0.0 Patch available CNA
- Pillow (PyPI) Vendor— Affected 2.3.0 to before 13.0.0 Fixed in 13.0.0 Patch available GHSA-vx6w-vv9f-6gvg
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
Upgrade Pillow to 13.0.0. Red Hat fixes AI Inference Server 3.5 in RHSA-2026:94738, RHSA-2026:94721, RHSA-2026:94717, RHSA-2026:94715, RHSA-2026:94709 and RHSA-2026:94702. Red Hat plans no fix for Exploit Intelligence and has none available for Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) and Red Hat Quay 3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA Pillow (python-pillow) Fixed in 13.0.0
- Fix · GHSA-vx6w-vv9f-6gvg Pillow (PyPI) Fixed in 13.0.0 Advisory →
Red Hat 6 advisories
- RHSA-2026:94738 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (CUDA)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:94721 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.3 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:94717 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (Spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
Show 3 more Red Hat advisories
- RHSA-2026:94715 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
- RHSA-2026:94709 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:94702 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (CPU)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:94702, RHSA-2026:94709, RHSA-2026:94715, RHSA-2026:94717, RHSA-2026:94721, RHSA-2026:94738 |
Timeline
- 2026-11-05 Threatist record created from CVE-2026-112899
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-vx6w-vv9f-6gvg
- https://github.com/python-pillow/Pillow/pull/10112
- https://github.com/python-pillow/Pillow/commit/3e8cc105588d1dfe062fcada0b6058c1b5f14b65
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow
More python-pillow vulnerabilities
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2022-24108 An XML External Entity (XXE) issue was discovered in Python through 3.9.1. CVSS 3.1CRITICAL 9.8
- TI-2022-17508 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and… CVSS 3.1CRITICAL 9.8
- TI-2021-02254 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c… CVSS 3.1CRITICAL 9.8
- TI-2007-04413 Directory traversal vulnerability in the (1) extract and (2) extractall functions in the… CVSS 3.1CRITICAL 9.8
- TI-2026-76627 Out-of-bounds read in Pillow TIFF encoder ColorMap handling CVSS 4.0HIGH 8.8
Sources
- CVE-2026-112899 · CVE Program
- CVE-2026-112899 · NVD
- FIRST EPSS
- CVE-2026-112899 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences