Is CVE-2026-40192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40192 being exploited in the wild.

How severe is CVE-2026-40192?

High severity, with a CVSS score of 7.5, published 15 April 2026.

Which products and versions are affected?

pillow (PyPI) >= 10.3.0, < 12.2.0, ECOSYSTEM:introduced=10.3.0,fixed=12.2.0.

Is there a fix for CVE-2026-40192?

Yes. pillow (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40192 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-40192?

Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40192: Python Pillow denial of service via FITS GZIP decompression bomb

Q: Is there a fix for CVE-2026-40192?

Yes. pillow (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40192 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-40192?

Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40192 · Severity: high · CVSS 7.5 · Published 2026-04-15

Pillow, a widely used Python library for image processing, is vulnerable to 'decompression bomb' attacks when handling FITS images. An attacker can provide a specially crafted image file that, when opened, consumes an excessive amount of system memory. This can lead to the application crashing or the entire server becoming unresponsive, disrupting business operations.

Technologies: pillow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-40192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40192 being exploited in the wild.
How severe is CVE-2026-40192?: High severity, with a CVSS score of 7.5, published 15 April 2026.
Which products and versions are affected?: pillow (PyPI) >= 10.3.0, < 12.2.0, ECOSYSTEM:introduced=10.3.0,fixed=12.2.0.
Is there a fix for CVE-2026-40192?: Yes. pillow (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40192 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-40192?: Check whether you run pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 12.2.0 or later
```
pip install "pillow>=12.2.0"
```

Technical details

A resource exhaustion vulnerability (CWE-400) exists in Pillow's FitsImagePlugin.py. The library failed to limit the amount of GZIP-compressed data read during the decoding of Flexible Image Transport System (FITS) images. An attacker can exploit this by providing a small, highly compressed FITS file that expands to a massive size in memory upon decompression. This results in an Out-Of-Memory (OOM) condition or severe performance degradation. The issue was introduced in version 10.3.0 and is fixed in version 12.2.0 by ensuring only the necessary amount of data is read from the decompressor.

Affected products

Python-Pillow Pillow >= 10.3.0, < 12.2.0

Identifiers

CVE-2026-40192
GHSA-whj4-6x5x-4v2j
PYSEC-2026-2250

Timeline

2026-03-31: patched: Fix merged into main branch via PR #9521
2026-04-01: advisory: Release notes for version 12.2.0 published
2026-04-10: disclosed: GitHub Security Advisory GHSA-whj4-6x5x-4v2j published
2026-04-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.