CVE-2026-112901: Pillow Image Processing Library Suffers from ReDoS Vulnerability in XbmImagePlugin
Summary
CVE-2026-112901: Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used open-source Python Imaging Library (PIL) that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is designed to be user-friendly and supports numerous image processing tasks, making it a popular choice among developers. However, a recently discovered vulnerability in the XbmImagePlugin component can lead to significant performance issues when handling specially crafted image files.
Vulnerability Detail
The vulnerability, identified as CVE-2026-112901, arises from a catastrophic backtracking issue in the regular expression used by the XbmImagePlugin to identify XBM files. A crafted 512-byte file can cause the Image.open() function to consume excessive CPU time, stalling for several minutes before ultimately failing with an UnidentifiedImageError. This vulnerability can be exploited by anyone who can upload or send image data to an application using Pillow, potentially leading to a denial of service by exhausting CPU resources.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can pass an allowlist of formats to the Image.open() function that excludes 'XBM'. This will prevent the vulnerable code from being executed. For example: 'Image.open(file, formats=['JPEG', 'PNG'])'.
Conclusion
The CVE-2026-112901 vulnerability in the Pillow library's XbmImagePlugin poses a significant risk due to its potential for denial of service through crafted image files. It is crucial for developers using Pillow to update to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112901 is a vulnerability in the Pillow library's XbmImagePlugin that allows for denial of service through regular expression backtracking.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Exploitation of this vulnerability can lead to significant CPU resource exhaustion, causing applications to become unresponsive or slow.
Yes, the vulnerability has been patched in Pillow version 13.0.0 and later. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
