CVE-2026-40192

🗓️ 15 Apr 2026 22:53:56Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 93 Views

Pillow is vulnerable to a FITS gzip decompression bomb in versions 10.3.0–12.1.1, causing memory DoS.

Reporter	Title	Published	Views	Family All 107
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Pillow [CVE-2026-40192]	21 May 202615:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192	15 Jun 202610:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-40192	29 May 202610:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202614:55	–	ibm
ATTACKERKB	CVE-2026-40192	15 Apr 202622:53	–	attackerkb
BDU FSTEC	The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.	20 Apr 202600:00	–	bdu_fstec
Chainguard	CVE-2026-40192 vulnerabilities	17 Apr 202607:18	–	cgr
Circl	CVE-2026-40192	16 Apr 202600:48	–	circl

NVD

Vulners

Node

python pillowRange10.3.0–12.2.0

[
  {
    "vendor": "python-pillow",
    "product": "Pillow",
    "versions": [
      {
        "version": ">= 10.3.0, < 12.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/python-pillow/Pillow/pull/9521
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
github	www.github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
access	www.access.redhat.com/errata/RHSA-2026:17609
access	www.access.redhat.com/errata/RHSA-2026:24853
access	www.access.redhat.com/errata/RHSA-2026:22840
access	www.access.redhat.com/errata/RHSA-2026:34368
access	www.access.redhat.com/errata/RHSA-2026:24761
access	www.access.redhat.com/errata/RHSA-2026:17611

20 Jul 2026 12:19Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.00671

SSVC

pillow vulnerability fits format gzip decompression bomb memory exhaustion