Pillow: Memory exhaustion in MSP RLE decoder via crafted image
Summary
Pillow, the Python imaging library, has a flaw in its MSP image plugin where a small crafted file can be expanded into an unbounded in-memory buffer. An attacker who can get an application that loads pixels to process such a file can exhaust memory and cause a denial of service. The declared-pixel-count check (MAX_IMAGE_PIXELS) does not stop this expansion.
Affected
- Pillow 4.1.0 through 12.3.0 (CVE record: >= 4.1.0, < 13.0.0)
Fixed in
- Pillow 13.0.0
Workaround
- Unknown from the vendor; upgrading to Pillow 13.0.0 is the only remedy listed.
- Third-party suggestion (not from the vendor): check MSP file size before decoding and reject files above a set limit.
- Restricting accepted image formats in the application so that MSP files are never parsed (untested).
Exploitation
- No known exploitation in the wild according to available sources.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS score about 0.004.
Our recommendation
- Identify all Pillow instances, including transitive dependencies, lockfiles and container images.
- Upgrade to Pillow 13.0.0 or later; this release also contains other security fixes.
- Prioritise internet-facing services that accept image uploads without authentication.
- Until patched, consider rejecting oversized MSP files before decoding.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gg2r-wvfm-q9rx github.com
- Fix commit 5dcb630 (Do not decode more MSP data than necessary) github.com
- Pillow 13.0.0 release github.com
- OSV entry GHSA-gg2r-wvfm-q9rx osv.dev
- Pillow 13.0.0 release notes pillow.readthedocs.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:50.
Original description (NVD)
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.