CVE-2026-112892: Pillow MSP RLE Decoder Memory Exhaustion Vulnerability

Background

Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. The library is known for its ease of use and extensive functionality, making it a popular choice among developers. However, a recent vulnerability in the MSP RLE decoder has raised concerns regarding memory management, potentially allowing crafted images to exhaust system memory.

Vulnerability Detail

The vulnerability arises from the MSP RLE decoder's handling of run-length encoded data, which expands into an in-memory buffer without a cap based on the declared image size. This means that a small, specially crafted image file can lead to excessive memory allocation, potentially exhausting system resources and causing a denial of service. The issue is located in the MspImagePlugin.py file, where the decoder writes each run into an unbounded io.BytesIO object. The expansion factor can be as high as 85 times per run, making it possible for a tiny image to consume hundreds of megabytes of memory.

pip install --upgrade "pillow==13.0.0"

Workaround

As a temporary workaround, you can implement checks in your application to limit the size of images being processed. For example, you can set a maximum pixel count or restrict the types of images that can be uploaded or processed. Here is a sample code snippet to limit image size:

from PIL import Image

MAX_IMAGE_PIXELS = 1000000  # Set a maximum pixel limit

def load_image(file_path):
    img = Image.open(file_path)
    if img.size[0] * img.size[1] > MAX_IMAGE_PIXELS:
        raise ValueError('Image exceeds maximum allowed size')
    return img

Conclusion

In summary, CVE-2026-112892 is a significant vulnerability in the Pillow library that can lead to memory exhaustion through crafted image files. It is crucial for developers using Pillow to update to the latest version to mitigate this risk. Implementing additional checks can also help safeguard applications against potential exploitation.

See every vulnerability recorded for pillow →

FAQ