The vulnerability CVE-2026-40192 in the python-pillow Pillow library affects versions 10.3.0 through 12.1.1. It arises from the lack of limits on the amount of GZIP-compressed data read during the decoding of FITS image files. This flaw enables decompression bomb attacks that cause unbounded memory allocation, leading to denial of service conditions such as out-of-memory crashes or significant performance degradation. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). No official patch or remediation level is specified in the provided data, but vendor advisories from Red Hat indicate security updates are available in their distributions.

Exploitation of this vulnerability can cause denial of service by exhausting system memory resources when processing maliciously crafted FITS images. This may result in application crashes or severe performance degradation, impacting availability of services using the affected Pillow versions.

No explicit patch or official fix status is provided in the input data. However, Red Hat advisories reference security updates addressing this issue, indicating that fixes are available in their product updates. Users should apply vendor-provided updates as soon as possible. If immediate upgrade is not feasible, a recommended workaround is to avoid opening FITS image files to prevent triggering the decompression bomb vulnerability.