{"schema":"threatline.record/2","record":{"id":"CVE-2026-112892","aliases":["GHSA-gg2r-wvfm-q9rx"],"summary":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","details":"### Summary\nThe MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels.\n\n### Details\nThe MSP decoder writes each run into an unbounded `io.BytesIO` and can expand roughly 85x per run:\n\n- `src/PIL/MspImagePlugin.py:144-146`\n\n### Impact\nMemory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. The expansion is decoupled from the declared pixel count, so `MAX_IMAGE_PIXELS` does not bound it.","categories":["Libraries & packages"],"product":"pillow","vendor":"python-pillow","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","source_modified_at":"2026-10-21T21:12:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pillow"},"range":">= 4.1.0, < 13.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112892","source_modified_at":"2026-10-22T21:11:24.689Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Pillow","vendor":"python-pillow","versions":[{"status":"affected","version":">= 4.1.0, < 13.0.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx","source_modified_at":"2026-10-21T21:30:26.946223137Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"13.0.0"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","source_modified_at":"2026-10-21T21:12:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pillow"},"version":"13.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx","source_modified_at":"2026-10-21T21:30:26.946223137Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"version":"13.0.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00291,"percentile":0.20606,"score_date":"2026-10-23"},"published_at":"2026-10-19T21:35:25.797Z","modified_at":"2026-10-22T21:11:24.689Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T21:12:57Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112892","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T21:11:24.689Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T21:30:26.946223137Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112892","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-22T21:11:15.830778Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-22T21:11:24.689Z","content_hash":"7f5796eb00d024b72ec893746055f3e980eabde21436b73d9e504ae19d633528"}}