CVE-2026-112901

Affected versions of the Pillow package are vulnerable to Regular Expression Denial of Service (ReDoS) due to a catastrophic backtracking pattern in the `xbm_head` regular expression. The `XbmImageFile._open()` method in `XbmImagePlugin.py` runs `xbm_head.match()` against the first 512 bytes of any stream whose prefix starts with `#define`, and the pattern contains several adjacent quantifiers—`[ \t]+` overlapping with `.*` and `[^_]*`, and `[\r\n]+` overlapping with the trailing `[\000-\377]*`—that can match the same characters in exponentially many ways when the final `_bits[]` literal is absent, forcing the backtracking engine to explore all possible splits. An attacker can exploit this by submitting a crafted 512-byte file containing repeated whitespace and line-terminator runs to any endpoint or service that calls `Image.open()` with default settings, such as an upload handler or thumbnailer, causing a single core to spend several minutes of CPU time per request and exhausting the application's worker pool through a handful of concurrent requests; `ImageFile.Parser.feed()` further amplifies the cost by repeating the match on every chunk until the stream is identified.