CVE-2026-40192

🗓️ 15 Apr 2026 22:53:56Reported by AttackerKBType

CVE-2026-40192 in Pillow 10.3.0–12.1.1 causes unbounded memory use decoding fits, risking DoS.

Reporter	Title	Published	Views	Family All 130
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Pillow [CVE-2026-40192]	21 May 202615:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192	15 Jun 202610:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026	5 Aug 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-40192	29 May 202610:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202614:55	–	ibm
BDU FSTEC	The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.	20 Apr 202600:00	–	bdu_fstec
Chainguard	CVE-2026-40192 vulnerabilities	17 Apr 202607:18	–	cgr

Vulners

Node

python-pillow pillowRange10.3.0–12.2.0

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
github	www.github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
github	www.github.com/python-pillow/Pillow/pull/9521

15 Apr 2026 23:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

EPSS0.00671

SSVC