CVE-2026-40192: Pillow is vulnerable to a FITS GZIP decompression bomb
Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).
Patches The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).
Workarounds Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.
Other sources
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 12.2.0 - Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.2.0Patch PR #9521 - Configuration
If unable to upgrade, configure Pillow to open only specific image formats using the 'formats' parameter, excluding FITS.
Pillow image-open (formats parameter) = Open only specific image formats and exclude FITS - Configuration
Do not run Pillow versions '>= 10.3.0, < 12.2.0' when decoding FITS, since they do not limit GZIP-compressed data read for FITS decoding (decompression bomb risk).
Pillow Do not use vulnerable versions for FITS decoding = Avoid Pillow >= 10.3.0, < 12.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40192?
CVE-2026-40192 is categorized as a high severity vulnerability due to the risk of denial of service from memory exhaustion.
How do I fix CVE-2026-40192?
To fix CVE-2026-40192, upgrade Pillow to version 12.2.0 or later.
What types of attacks are possible with CVE-2026-40192?
CVE-2026-40192 allows for decompression bomb attacks that could consume excessive memory.
What versions of Pillow are affected by CVE-2026-40192?
Versions of Pillow from 10.3.0 up to but not including 12.2.0 are affected by CVE-2026-40192.
What is the primary impact of CVE-2026-40192?
The primary impact of CVE-2026-40192 is unbounded memory consumption leading to denial of service.