CVE-2026-112899 with a CVSS score of 6.9 is a resource exhaustion vulnerability in Pillow's EPS image handling, where the EPS load(scale) path allows Ghostscript to render content past the intended decompression bomb limit. The flaw affects the Pillow component that processes EPS files and relies on Ghostscript for rendering, creating an improper restriction on resource consumption. An attacker can exploit it over a network with low complexity, without requiring privileges or user interaction, by supplying a crafted EPS file to an application that uses Pillow to load or process the image. The attack does not require authentication or special access, and the resulting excessive rendering can consume memory, CPU, or other system resources. The business impact is primarily availability loss, because affected services may become slow, unresponsive, or unavailable while processing malicious EPS content, potentially disrupting image processing pipelines, web applications, document conversion workflows, or user-facing systems that accept uploaded EPS files. The vulnerability does not indicate direct confidentiality or integrity impact, but the availability degradation can affect operational continuity, customer experience, and support costs.
We recommend you to update Pillow to version 13.0.0.[/subscribe_to_unlock_form]
CVE-2026-112899 with a CVSS score of 6.9 is a resource exhaustion vulnerability in Pillow's EPS image handling, where the EPS load(scale) path allows Ghostscript to render content past the intended decompression bomb limit. The flaw affects the Pillow component that processes EPS files and relies on Ghostscript for rendering, creating an improper restriction on resource consumption. An attacker can exploit it over a network with low complexity, without requiring privileges or user interaction, by supplying a crafted EPS file to an application that uses Pillow to load or process the image. The attack does not require authentication or special access, and the resulting excessive rendering can consume memory, CPU, or other system resources. The business impact is primarily availability loss, because affected services may become slow, unresponsive, or unavailable while processing malicious EPS content, potentially disrupting image processing pipelines, web applications, document conversion workflows, or user-facing systems that accept uploaded EPS files. The vulnerability does not indicate direct confidentiality or integrity impact, but the availability degradation can affect operational continuity, customer experience, and support costs.
We recommend you to update Pillow to version 13.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]