Most recent entries from all

BREW-aider-CVE-2026-112892 — Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Affected: Homebrew: aider

### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.

### Details The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:

- `src/PIL/MspImagePlugin.py:144-146`

### Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.

fkie_cve-2026-112892

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.

GHSA-gg2r-wvfm-q9rx — Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Affected: PyPI: pillow

### Details The MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:

- `src/PIL/MspImagePlugin.py:144-146`

openSUSE-SU-2026:12230-1 — python313-Pillow-13.0.0-1.1 on GA media

python313-Pillow-13.0.0-1.1 on GA media

UBUNTU-CVE-2026-112892

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.04:LTS: pillow, Ubuntu:26.10: pillow, Ubuntu:26.04:LTS: pillow

(Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's ...)