Is CVE-2026-112901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112901 being exploited in the wild.

How severe is CVE-2026-112901?

Medium severity, with a CVSS score of 4, published 19 October 2026.

Which products and versions are affected?

pillow (PyPI) <= 12.3.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Contributors Pillow prior to 13.0.0.

Is there a fix for CVE-2026-112901?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112901 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112901?

Check whether you run pillow (PyPI) or Python Pillow Contributors Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112901: Pillow XBM header regular-expression denial of service

Q: Which products and versions are affected?

pillow (PyPI) <= 12.3.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Contributors Pillow prior to 13.0.0.

Q: Is there a fix for CVE-2026-112901?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112901 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-112901?

Check whether you run pillow (PyPI) or Python Pillow Contributors Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112901 · Severity: medium · CVSS 4 · Published 2026-10-19

Pillow is a widely-used Python library for image processing. A vulnerability in its XBM image file parser allows an attacker to craft a malicious XBM file that, when opened by an application, causes the parser to hang for minutes due to catastrophic regex backtracking. This denial of service can disrupt any application using Pillow to process untrusted image files.

Technologies: pillow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-112901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112901 being exploited in the wild.
How severe is CVE-2026-112901?: Medium severity, with a CVSS score of 4, published 19 October 2026.
Which products and versions are affected?: pillow (PyPI) <= 12.3.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Contributors Pillow prior to 13.0.0.
Is there a fix for CVE-2026-112901?: Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112901 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112901?: Check whether you run pillow (PyPI) or Python Pillow Contributors Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 13.0.0 or later
```
pip install "pillow>=13.0.0"
```

Technical details

XbmImageFile._open in Pillow prior to 13.0.0 applies a backtracking regular expression to attacker-controlled XBM file headers before validating image dimensions. A crafted XBM file triggers exponential regex backtracking, blocking the worker thread. The vulnerability requires only that Image.open() be called on the malicious file; no authentication or elevated privileges are needed. Fixed in version 13.0.0 by switching from regex-based parsing to line-by-line header reading.

Affected products

Python Pillow Contributors Pillow prior to 13.0.0

Identifiers

CVE-2026-112901
BIT-PILLOW-2026-112901
GHSA-xgh8-jp6q-p5x8
PYSEC-2026-4335

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.