CVE-2026-112899: Pillow EPS Load Vulnerability Allows Excessive Resource Consumption
Summary
CVE-2026-112899: Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit. Affects pillow versions >= 2.3.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is known for its ease of use and versatility, making it a popular choice among developers for image processing tasks. However, a vulnerability has been identified in the EPS loading functionality, which can lead to excessive resource consumption when handling untrusted EPS files.
Vulnerability Detail
The vulnerability arises from the way Pillow handles EPS files during rendering. Specifically, when an application requests Pillow to render an EPS file at a larger scale, it allows Ghostscript to produce an image that exceeds the configured size limit. The size check is performed only after Ghostscript has completed rendering, which can lead to significant resource consumption, including CPU and disk space. An attacker can exploit this by uploading a small EPS file that, when rendered at a higher scale, results in a temporary file that is several times larger than intended. This can lead to denial-of-service conditions as the application consumes excessive resources.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, applications should avoid rendering untrusted EPS files at scales greater than 1 until the package is updated. Additionally, developers can implement their own checks to validate the size of the EPS files before passing them to Pillow for rendering.
Conclusion
The CVE-2026-112899 vulnerability in Pillow poses a significant risk when handling untrusted EPS files, potentially leading to resource exhaustion. It is crucial for developers to update to the patched version of Pillow and implement appropriate checks to mitigate this risk.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112899 is a vulnerability in the Pillow library that allows excessive resource consumption when rendering untrusted EPS files at a larger scale.
If your application uses Pillow versions 2.3.0 to 12.3.0 and handles EPS files, it may be affected. You can check your application's dependencies using tools like Vulert.
The vulnerability can lead to denial-of-service conditions due to excessive CPU and disk space consumption when rendering large EPS files.
Yes, the vulnerability has been patched in Pillow version 13.0.0. It is recommended to update to this version or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock. You can also check for vulnerabilities without signup using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
