CVE-2026-112901

A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted XBM (X BitMap) image file. When the application parses the image header, an inefficient regular expression causes excessive computational backtracking, stalling worker processes and leaving the service unresponsive.

This vulnerability is rated as Moderate impact because an attacker can cause CPU exhaustion and stall individual service worker processes by submitting a malformed image, without compromising system confidentiality or integrity. In Red Hat environments, Pillow is embedded across multiple platform services and containerized tools to handle graphic operations. Real-world impact is largely confined to endpoints that ingest untrusted image uploads without enforcing strict format restrictions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.