CVE-2026-112899

A flaw was found in Pillow. The Encapsulated PostScript EPS image loader only validates decompression bomb limits against the unscaled dimensions defined in the file, rather than the final scaled dimensions requested during rendering. An attacker can exploit this issue by providing a crafted EPS...