CVE-2026-112899

A flaw was found in Pillow. The Encapsulated PostScript (EPS) image loader only validates decompression bomb limits against the unscaled dimensions defined in the file, rather than the final scaled dimensions requested during rendering. An attacker can exploit this issue by providing a crafted EPS file, forcing the rendering process to generate excessively large temporary files and consume excessive CPU and disk resources, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because it results in a denial of service through excessive CPU and storage consumption without compromising system confidentiality or integrity. In Red Hat environments, exploitation requires an application using the Pillow library to ingest untrusted Encapsulated PostScript (EPS) files and perform scaled rendering via Ghostscript. Because the risk is confined to availability exhaustion and does not allow remote code execution or privilege escalation, the blast radius is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Operational controls can mitigate exposure to this vulnerability:

1. Restrict file formats: Configure applications using Pillow to validate and accept only required raster formats (such as PNG or JPEG), preventing untrusted EPS files from being processed.
2. Remove the Ghostscript rendering backend: If PostScript or EPS rendering is not required, remove the Ghostscript package to prevent Pillow from delegating rendering to it:

dnf remove ghostscript

3. Sandbox and resource limits: Run image processing workloads in containerized or sandboxed environments with strict disk quota and CPU limits to prevent excessive temporary file generation from exhausting host resources.

Caveats: Removing Ghostscript will disable EPS and PostScript rendering capabilities across the system for any applications that depend on Ghostscript.