CVE-2026-40192

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770 CWE-409

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Sep 10, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-401938.2maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where CVE-2026-401943.7phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_CVE-2026-401956.5Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import log CVE-2026-401968.1HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained per CVE-2026-401976.5Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import log CVE-2026-401987.5Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not chec CVE-2026-401996.5Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes t CVE-2026-40207.5The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is d CVE-2026-402008.1An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to CVE-2026-402015.4@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.CVE-2026-402033.7When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attac CVE-2026-402043.1None None None No publicly available exploits are known.