CVE-2026-112899: Pillow EPS load decompression bomb check bypass in Ghostscript scaling

CVE-2026-112899 · Severity: medium · CVSS 4 · Published 2026-11-05

Pillow, an image processing library, fails to validate scaled output size before sending EPS files to Ghostscript for rendering. An attacker can upload a small EPS file that bypasses size checks, causing Pillow to render vastly larger images at higher scales, wasting CPU, temporary disk space, and potentially creating denial-of-service conditions for applications processing untrusted documents.

Technologies: Pillow, pillow (PyPI). Vendors: Pillow, PyPI.

Quick answers

Is CVE-2026-112899 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112899 being exploited in the wild.
How severe is CVE-2026-112899?
Medium severity, with a CVSS score of 4, published 5 November 2026.
Which products and versions are affected?
Pillow before fix (affects all versions since 2.5.0); pillow (PyPI) >= 2.3.0, <= 12.3.0, ECOSYSTEM:introduced=2.3.0,fixed=13.0.0.
Is there a fix for CVE-2026-112899?
Yes. pillow (PyPI): upgrade to 13.0.0 or later. Until then: Do not call load(scale=N) with N > 1 on untrusted EPS files, or restrict Ghostscript execution to trusted input only. Alternatively, convert the MAX_IMAGE_PIXELS warning to an error to catch oversized outputs after Ghostscript processing. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112899 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-112899?
Check whether you run Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pillow (PyPI): upgrade to 13.0.0 or later
    pip install "pillow>=13.0.0"

Do not call load(scale=N) with N > 1 on untrusted EPS files, or restrict Ghostscript execution to trusted input only. Alternatively, convert the MAX_IMAGE_PIXELS warning to an error to catch oversized outputs after Ghostscript processing.

Technical details

The vulnerability exists in EpsImagePlugin.Ghostscript() where the scaled pixel dimensions (width × scale, height × scale) are computed but never passed to Image._decompression_bomb_check() before invoking the Ghostscript subprocess. The only size check occurs in Image.open() on the unscaled dimensions; a file declaring 9000×9000 pixels (81 Mpx, below the default MAX_IMAGE_PIXELS) passes, but load(scale=2) requests 18000×18000 pixels (324 Mpx, 3.6× the limit) from Ghostscript, producing a 972 MB temporary file. The attack requires the application to call load(scale=N) with N > 1 on untrusted EPS files.

Affected products

  • Pillow Pillow before fix (affects all versions since 2.5.0)

Identifiers

  • CVE-2026-112899
  • GHSA-vx6w-vv9f-6gvg

Timeline

  • 2026-10-20: disclosed: GHSA-vx6w-vv9f-6gvg published
  • 2026-10-20: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.