MEDIUM GitHub
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
```
============================================================================
EPS load(scale) lets Ghostscript render past the decompression bomb limit
Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```
When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image
Affected Products
- pip/Pillow >= 2.3.0, <= 12.3.0
References
- https://github.com/advisories/GHSA-vx6w-vv9f-6gvg
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-vx6w-vv9f-6gvg
- https://github.com/python-pillow/Pillow/commit/3e8cc105588d1dfe062fcada0b6058c1b5f14b65
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
This medium severity vulnerability was published on 2026-10-20 via GitHub. Affected: pip/Pillow >= 2.3.0, <= 12.3.0.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.