Pillow, a popular Python imaging library, allows FITS images to be decoded without imposing limits on the amount of GZIP‑compressed data that may be decompressed. A maliciously crafted FITS file can therefore trigger unbounded memory allocation, causing the process to run out of memory, crash, or become severely slowed. This results in a denial of service to the application or system using Pillow. The weakness is a form of uncontrolled resource consumption (CWE‑400), unexpected resource allocation (CWE‑409), and allocation without limits (CWE‑770).

The vulnerability affects Pillow versions 10.3.0 through 12.1.1. Users running any of those releases are at risk. The issue is fixed in Pillow 12.2.0 and later; all later releases impose a limit on FITS GZIP decompression.

The CVSS score of 8.7 categorises the vulnerability as High, and the EPSS score of < 1% indicates a very low but non‑zero exploitation probability; an official patch that enforces limits is available, yet exploitation remains feasible if the patch is not applied. Based on the description, it is inferred that an attacker could trigger the bug by serving a malicious FITS file to an application that imports or opens untrusted images. The vulnerability is not listed in the CISA KEV catalog, but its impact mandates swift action, especially for services that process user supplied images.