The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.

🗓️ 20 Apr 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 14 Views

Pillow image library vulnerability enables unlimited resource distribution, causing service failures.

Reporter	Title	Published	Views	Family All 112
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Pillow [CVE-2026-40192]	21 May 202615:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192	15 Jun 202610:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026	5 Aug 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-40192	29 May 202610:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202614:55	–	ibm
ATTACKERKB	CVE-2026-40192	15 Apr 202622:53	–	attackerkb
Chainguard	CVE-2026-40192 vulnerabilities	17 Apr 202607:18	–	cgr

Vulners

Node

OR

red_hat red_hat_quayMatch3

red_hat red_hat_satelliteMatch6

red_hat ansible_automation_platformMatch2

uploadcare,_llc pillowRange10.3.0–12.2.0

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linux_aiMatch3

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-40192
ubuntu	www.ubuntu.com/security/CVE-2025-40192
access	www.access.redhat.com/security/cve/cve-2026-40192
github	www.github.com/python-pillow/Pillow/commit/142473c7b43a72b5dba534a26cb614b5b207ada5
github	www.github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
repo	www.repo.red-soft.ru/redos/8.0/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

05 Aug 2026 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.00671

Pillow library image processing unlimited resources remote exploitation service failures