CVE-2026-40192: Pillow FITS Image GZIP Decompression Bomb Denial of Service

HERMES

HERMES THREAT SCORE & APPLICATION RUNTIME ATTACK SURFACE

Target: Pillow (src/PIL/FitsImagePlugin.py)

Confidence: 94%

84 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-40192 at 7.5 (HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The Hermes Threat Score evaluates operational impact at 84 (HIGH) reflecting broad ecosystem exposure across data pipelines, MLOps, and developer environments.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-40192: Pillow FITS Image GZIP Decompression Bomb Denial of ServiceVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTPillow Python Imaging Library

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Pillow Python Imaging Library documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-400: Uncontrolled Resource Consumption ('Decompression Bomb')

CVSS v3.1 : 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) / CWE-400: Uncontrolled Resource Consumption (‘Decompression Bomb’). Addressed in official upstream release 12.2.0.

Executive Summary

CVE-2026-40192 affects Pillow (the primary Python Imaging Library fork) versions 10.3.0 through 12.1.1. When decoding Flexible Image Transport System (FITS) files commonly utilized in astronomical, scientific, and medical imaging, Pillow supports reading GZIP-compressed data streams. However, Pillow failed to apply decompression limits or respect Image.MAX_IMAGE_PIXELS during GZIP stream decompression in FitsImagePlugin.py. A tiny 10KB weaponized FITS file can expand into tens of gigabytes of raw raster data in RAM, crashing web services and batch processors via OOM (Out of Memory).

---

1. Technical Context & Affected Software Matrix

The component Pillow (src/PIL/FitsImagePlugin.py) provides fundamental runtime services and data parsing across Python microservices, analytics pipelines, and AI platforms.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-40192	Official Upstream Security Release
Affected Product	python-pillow:pillow	Python Ecosystem Component
Vulnerable Component	Pillow (src/PIL/FitsImagePlugin.py)	Standard Library / Package Utility
Weakness Class	CWE-400: Uncontrolled Resource Consumption ('Decompression Bomb')	Execution / Resource Safety Flaw
CVSS v3.1 Score	7.5 (HIGH / Hermes Score 84)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed Version	12.2.0	Official upstream patch release
MITRE ATT&CK	T1499 - Endpoint Denial of Service, T1203 - Exploitation for Client Execution	Execution / Denial of Service
Forensic Cross-Reference	Process Memory and Out-Of-Memory Crash Forensics	Memory analysis and process diagnostics

---

2. In-Depth Technical Decomposition & Root Cause

Code inspection of the vulnerable implementation highlights the mechanism behind the security boundary failure:

# Bug in src/PIL/FitsImagePlugin.py (_open)
def _open(self):
    header = self.fp.read(80)
    if is_gzip(header):
        # VULNERABILITY: Reads and decompresses the entire GZIP stream
        # with zero size limitation or MAX_IMAGE_PIXELS check!
        gz = gzip.GzipFile(fileobj=self.fp)
        self.fp = io.BytesIO(gz.read()) # Unbounded expansion exhausts RAM!

When unvetted user input reaches this routine, the application encounters an unhandled edge case or unbounded processing loop, destabilizing the execution environment or enabling control-flow manipulation.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: An attacker uploads an avatar, profile photo, or scientific dataset containing a 15KB gzip-compressed FITS file with a high compression ratio.
2. Triggering Primitive: The attacker injects crafted payload data targeting Pillow (src/PIL/FitsImagePlugin.py).
3. Control Bypass / Resource Saturation: Bug in src/PIL/FitsImagePlugin.py (_open).
4. Impact Realization: When the Django/FastAPI image thumbnailing task calls Image.open(file), the worker inflates the payload to 32GB of RAM, triggering Linux OOM killer termination of all API workers..

---

4. Forensic Detection, Artifacts & System Logs

Security operations centers and incident response teams can identify exploitation activity through process telemetry, memory dumps, and operating system audit trails.

Process Telemetry & Logs

Inspect application logs and process crash diagnostics matching: Out of memory: Killed process [pid] (python3/celery) total-vm:34522816kB anon-rss:31892012kB. Monitor for abnormal CPU spikes or unexpected out-of-memory terminations.

System Auditing & Call Tracing

Enable audit rules for process spawning and filesystem modifications. Consult Process Memory and Out-Of-Memory Crash Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_40192.yaml

title: Pillow Massive Memory Spike from FITS Image Decompression Bomb
id: cve-2026-40192
status: experimental
description: Detects anomalies and resource abuse associated with CVE-2026-40192.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        - 'Out'
        - 'pillow'
    condition: selection
fields:
    - CommandLine
    - User
level: high

eBPF Tracepoint

# Monitor invocations associated with python-pillow:pillow
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "python3"/ {
    printf("PID %d spawned: %s\n", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

Immediate remediation involves upgrading to patched library versions and enforcing input sanitization best practices:

1. Package Upgrade: Update python-pillow:pillow to version 12.2.0 or higher using pip install --upgrade or distribution security repositories.
2. Defensive Programming: Enforce strict size quotas, input schema validation, and disable unsafe deserialization primitives (replace pickle with safetensors or JSON).
3. Forensic Guidance: For complete forensic telemetry workflows, consult our guide on Process Memory and Out-Of-Memory Crash Forensics.