Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8 Exploit, Mitigation, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 8
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-27 14:54
- StatusPublished → AnalyzedNVD modified 2026-10-27 14:54
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-20 16:08
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:50
- StatusReceived → PublishedNVD modified 2026-10-20 16:08
- StatusPublished → ReceivedNVD modified 2026-10-20 17:17
- StatusReceived → PublishedNVD modified 2026-10-19 22:09
- First seenCVSS 6.9NVD modified 2026-10-19 22:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 3
- https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8 Exploit, Mitigation, Patch, Vendor Advisory