DEBIAN-CVE-2026-112899

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-112899
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112899.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-112899
Upstream
Published
2026-11-05T21:18:36Z
Modified
2026-11-06T16:00:06Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0.

References

Affected packages

Debian:12 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.0-1.1
9.4.0-1.1+deb12u1
9.5.0-1
10.*
10.0.0-1
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.4.0-1
10.4.0-1.1
11.*
11.1.0-1
11.1.0-2
11.1.0-3
11.1.0-4
11.1.0-5
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112899.json"

Debian:13 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.1.0-5
11.1.0-5+deb13u1
11.1.0-5+deb13u2
11.1.0-5+deb13u3
11.1.0-5+deb13u4
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112899.json"

Debian:14 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.1.0-5
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112899.json"