CVE-2026-112899
Description
A flaw was found in Pillow. The Encapsulated PostScript (EPS) image loader only validates decompression bomb limits against the unscaled dimensions defined in the file, rather than the final scaled dimensions requested during rendering. An attacker can exploit this issue by providing a crafted EPS file, forcing the rendering process to generate excessively large temporary files and consume excessive CPU and disk resources, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate severity because it results in a denial of service through excessive CPU and storage consumption without compromising system confidentiality or integrity. In Red Hat environments, exploitation requires an application using the Pillow library to ingest untrusted Encapsulated PostScript (EPS) files and perform scaled rendering via Ghostscript. Because the risk is confined to availability exhaustion and does not allow remote code execution or privilege escalation, the blast radius is limited.
Mitigation
Operational controls can mitigate exposure to this vulnerability:
1. Restrict file formats: Configure applications using Pillow to validate and accept only required raster formats (such as PNG or JPEG), preventing untrusted EPS files from being processed.
2. Remove the Ghostscript rendering backend: If PostScript or EPS rendering is not required, remove the Ghostscript package to prevent Pillow from delegating rendering to it:
# dnf remove ghostscript
3. Sandbox and resource limits: Run image processing workloads in containerized or sandboxed environments with strict disk quota and CPU limits to prevent excessive temporary file generation from exhausting host resources.
Caveats: Removing Ghostscript will disable EPS and PostScript rendering capabilities across the system for any applications that depend on Ghostscript.
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce decompression bomb limit checks against the final scaled image dimensions before delegating EPS rendering to Ghostscript in Pillow: upgrade to Pillow 13.0.0+ (or the corresponding fixed Red Hat builds), which validate decompression bomb limits against the final scaled dimensions rather than unscaled dimensions before invoking Ghostscript, closing crafted EPS image file. Until patched, this is a concern on Applications using Pillow to load untrusted EPS files and perform scaled rendering with Ghostscript installed, so Restrict accepted image formats to required raster types such as PNG or JPEG, remove the ghostscript package if PostScript rendering is not needed, and isolate image processing with strict disk quotas. As a compensating measure, Enforce process resource limits on CPU time, process memory, and generated file sizes using ulimit or prlimit and Constrain CPU, memory, and I/O consumption using cgroups v2 resource limits for containerized image processing workloads. These controls limit blast radius and contain exploitation, but they do not fix the underlying decompression bomb limit validation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
