CVE-2026-112901: Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Pillow versions earlier than 13.0.0 are exposed if they call Image.open() on XBM files whose contents can be influenced by an attacker. The affected parsing occurs in the XBM header before image dimensions are accepted.
What does an attacker need to exploit it?
An attacker needs to provide a crafted, small XBM file for the application to open with Image.open(). No privileges or user interaction are required according to the supplied CVSS vector.
What is the operational impact?
Processing a crafted XBM file can cause the XBM header parser to stall a worker for minutes due to regular-expression backtracking. This can deny availability to workloads that process attacker-controlled images.
What should be done if upgrading cannot happen immediately?
The provided data identifies version 13.0.0 as the fix. Until upgrading, avoid passing untrusted XBM files to Pillow's Image.open() where possible.