CVE-2026-112892

A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding (RLE) decoder expands image data into an unbounded memory buffer, resulting in memory exhaustion and application crashes.

This vulnerability is evaluated as an Important impact because remote unauthenticated actors can induce an application denial of service by consuming all host or container memory, bypassing standard decompression safety limits. In Red Hat deployments such as Red Hat OpenShift AI and Red Hat Quay, service ingestion workflows accepting user-submitted graphics could suffer process termination or node instability when decoding untrusted assets. Deployments that process only verified internal content or do not expose image analysis to external inputs face substantially lower operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.