Pillow versions 10.3.0 through 12.1.1 do not limit the amount of GZIP-compressed data read when decoding FITS image files, making them vulnerable to decompression bomb attacks. A maliciously crafted FITS file can cause unbounded memory consumption, resulting in denial of service through out-of-memory crashes or severe performance degradation. The vulnerability is tracked as CVE-2026-40192 and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Handling of Highly Compressed Data). Red Hat's advisory confirms the issue but states that no mitigation or fix meeting their criteria is currently available. Users are advised to avoid opening FITS images if immediate upgrade is not possible. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, no privileges required, and high impact on availability.

Exploitation of this vulnerability can cause unbounded memory consumption on systems processing malicious FITS images, leading to denial of service conditions such as out-of-memory crashes or severe performance degradation. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Currently, no official fix meeting Red Hat's criteria for ease of use, applicability, and stability is available. Users unable to upgrade immediately should mitigate risk by avoiding opening FITS image files. Monitor vendor advisories for updates and apply patches once released.