CVE-2026-112899

This vulnerability is rated as Moderate severity because it results in a denial of service through excessive CPU and storage consumption without compromising system confidentiality or integrity. In Red Hat environments, exploitation requires an application using the Pillow library to ingest untrusted Encapsulated PostScript (EPS) files and perform scaled rendering via Ghostscript. Because the risk is confined to availability exhaustion and does not allow remote code execution or privilege escalation, the blast radius is limited.

Operational controls can mitigate exposure to this vulnerability:

1. Restrict file formats: Configure applications using Pillow to validate and accept only required raster formats (such as PNG or JPEG), preventing untrusted EPS files from being processed.

2. Remove the Ghostscript rendering backend: If PostScript or EPS rendering is not required, remove the Ghostscript package to prevent Pillow from delegating rendering to it:

# dnf remove ghostscript

3. Sandbox and resource limits: Run image processing workloads in containerized or sandboxed environments with strict disk quota and CPU limits to prevent excessive temporary file generation from exhausting host resources.

Caveats: Removing Ghostscript will disable EPS and PostScript rendering capabilities across the system for any applications that depend on Ghostscript.

--- CME Mitigation Guidance (2026-11-04) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce decompression bomb limit checks against the final scaled image dimensions before delegating EPS rendering to Ghostscript in Pillow: upgrade to Pillow 13.0.0+ (or the corresponding fixed Red Hat builds), which validate decompression bomb limits against the final scaled dimensions rather than unscaled dimensions before invoking Ghostscript, closing crafted EPS image file. Until patched, this is a concern on Applications using Pillow to load untrusted EPS files and perform scaled rendering with Ghostscript installed, so Restrict accepted image formats to required raster types such as PNG or JPEG, remove the ghostscript package if PostScript rendering is not needed, and isolate image processing with strict disk quotas. As a compensating measure, Enforce process resource limits on CPU time, process memory, and generated file sizes using ulimit or prlimit and Constrain CPU, memory, and I/O consumption using cgroups v2 resource limits for containerized image processing workloads. These controls limit blast radius and contain exploitation, but they do not fix the underlying decompression bomb limit validation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)