https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T21:19:48.752981+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-aider-cve-2026-112892 BREW-aider-CVE-2026-112892 — Pillow: MSP RLE decoder expands a tiny file into unbounded memory 2026-10-23T21:19:48.803247+00:00

Affected: Homebrew: aider

### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.

### Details The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:

- `src/PIL/MspImagePlugin.py:144-146`

### Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.

 https://db.gcve.eu/vuln/fkie_cve-2026-112892 fkie_cve-2026-112892 2026-10-23T21:19:48.803631+00:00

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.

 https://db.gcve.eu/vuln/ghsa-gg2r-wvfm-q9rx GHSA-gg2r-wvfm-q9rx — Pillow: MSP RLE decoder expands a tiny file into unbounded memory 2026-10-23T21:19:48.803700+00:00

Affected: PyPI: pillow

### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.

### Details The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:

- `src/PIL/MspImagePlugin.py:144-146`

### Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.

 https://db.gcve.eu/vuln/opensuse-su-2026:12230-1 openSUSE-SU-2026:12230-1 — python313-Pillow-13.0.0-1.1 on GA media 2026-10-23T21:19:48.803730+00:00

python313-Pillow-13.0.0-1.1 on GA media

 https://db.gcve.eu/vuln/ubuntu-cve-2026-112892 UBUNTU-CVE-2026-112892 2026-10-23T21:19:48.803759+00:00

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.04:LTS: pillow, Ubuntu:26.10: pillow, Ubuntu:26.04:LTS: pillow

(Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's ...)