CVE-2026-40192 affects the Pillow Python imaging library by failing to limit the amount of GZIP-compressed data read when decoding FITS image files. This flaw enables a decompression bomb attack that can cause unbounded memory consumption, leading to denial of service via out-of-memory crashes or severe performance degradation. The vulnerability impacts Pillow versions from 10.3.0 up to but not including 12.2.0. Red Hat has identified affected products including Red Hat Enterprise Linux AI 3.3.3 but currently does not provide a patch or fix meeting their criteria. The vulnerability is tracked under CWE-770, CWE-400, and CWE-409, relating to resource allocation without limits and improper handling of compressed data. Mitigation options are limited to avoiding processing FITS images until an update is available.

The vulnerability allows remote attackers to cause denial of service by triggering unbounded memory consumption during FITS image decoding, potentially crashing the system or severely degrading performance. There is no impact on confidentiality or integrity. The CVSS v3 score is 8.7 (high severity) with network attack vector, no privileges required, and no user interaction needed.

Currently, no official fix or patch is available from Red Hat for affected products. Users are advised to avoid opening FITS image files as a workaround to prevent exploitation. Monitor Red Hat advisories for future updates or patches. Customers with Red Hat Technical Account Managers can seek direct guidance. Applying mitigations or upgrading to a fixed version when available is recommended.