{
  "cveId": "CVE-2026-40192",
  "url": "https://patchblox.com/security/cve/CVE-2026-40192",
  "summary": "CVE-2026-40192 is fixed in 4 products on 1 platform, first by python3-pil 12.1.1-2ubuntu1.1, released April 16, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "pillow: Pillow is a Python imaging library",
  "description": "Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.",
  "published": "2026-04-15T23:16:10Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00671,
  "epssPercentile": 0.52259,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "pillow",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "11.1.0-5\u002Bdeb13u2",
      "fix": "DEBIAN-CVE-2026-40192",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40192",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "pillow",
      "release": "Debian 14",
      "fixedVersion": "12.2.0-1",
      "fix": "DEBIAN-CVE-2026-40192",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-40192",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "python-Pillow",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "11.3.0-160000.4.1",
      "fix": "OPENSUSE-SU-2026:20617-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20617-1",
      "released": "2026-04-22T21:45:29Z"
    },
    {
      "platform": "linux",
      "product": "python3-pil",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "11.3.0-1ubuntu1.2",
      "fix": "python3-pil 11.3.0-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-pil-11.3.0-1ubuntu1.2",
      "released": "2026-05-15T16:01:35Z"
    },
    {
      "platform": "linux",
      "product": "python3-pil",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "12.1.1-2ubuntu1.1",
      "fix": "python3-pil 12.1.1-2ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-pil-12.1.1-2ubuntu1.1",
      "released": "2026-04-16T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pil.imagetk",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "11.3.0-1ubuntu1.2",
      "fix": "python3-pil.imagetk 11.3.0-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-pil.imagetk-11.3.0-1ubuntu1.2",
      "released": "2026-05-15T16:01:35Z"
    },
    {
      "platform": "linux",
      "product": "python3-pil.imagetk",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "12.1.1-2ubuntu1.1",
      "fix": "python3-pil.imagetk 12.1.1-2ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-pil.imagetk-12.1.1-2ubuntu1.1",
      "released": "2026-04-16T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}