A tiny MSP file expands without bound in Pillow's run-length decoder

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Advisory

CVE-2026-112892

Library

Pillow, pillow on PyPI

Published

2026-10-21

Severity

not scored upstream

Affected

< 12.3.0

Fixed in

12.3.0

Reaches you

by opening a file

What triggers it

Image.open and load on a crafted Microsoft Paint (MSP) file.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

An MSP file is not one of the four formats a scan can be; sillybos does not know the format and refuses it as unknown before Pillow sees it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_an_unknown_format

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Open with formats limited to the readers you mean to use, as open_checked does; a file of any other format is refused before Pillow sees it.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx
• The record entry, triaged 2026-11-03, last checked 2026-11-03