Loading an EPS at a scale lets Ghostscript render past the bomb limit
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
- Advisory
- CVE-2026-112899
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- not scored upstream
- Affected
- < 12.3.0
- Fixed in
- 12.3.0
- Reaches you
- by opening a file
What triggers it
Image.open on an EPS file, then load(scale=n) with n above 1.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A PostScript file is refused by name before Pillow sees it; nothing from outside should reach the EPS reader or Ghostscript.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 12.3.0.
Specifically. Refuse PostScript by name, as sillybos does by default.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-vx6w-vv9f-6gvg
- The record entry, triaged 2026-11-03, last checked 2026-11-03