CVE-2026-25990
published 2026-02-11CVE-2026-25990: Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
29.1th percentile
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pillow | < pillow 12.1.1-1 (forky) | pillow 12.1.1-1 (forky) |
| python-pillow | pillow | — | — |
| python | pillow | >= 0 < 11.1.0-5+deb13u1 | 11.1.0-5+deb13u1 |
| python | pillow | >= 0 < 12.1.1-1 | 12.1.1-1 |
| python | pillow | >= 10.3.0 < 12.1.1 | 12.1.1 |
| python | pillow | >= 10.3.0 < 12.1.1 | 12.1.1 |
| python | pillow | >= 10.3.0 < 12.2.0 | 12.2.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.6HIGH
osv8.9HIGH
vendor_debian8.9LOW
vendor_redhat8.9HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Pillow vulnerability
vendor_ubuntu·2026-02-17
CVE-2026-25990 Pillow vulnerability
Title: Pillow vulnerability
Summary: Pillow could be made to crash or run programs if it opened a specially
crafted file.
Yarden Porat discovered that Pillow incorrectly handled certain malformed
PSD images. An attacker could use this issue to cause Pillow to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
vendor_redhat·2026-02-11·CVSS 8.9
CVE-2026-25990 [HIGH] CWE-787 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
A flaw was found the Pillow Python imaging library. Providing a specially crafted PSD image may lead to an out-of-bounds write. This could potentially allow for arbitrary code execution or information disclosure.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: openshift-lightspeed/lightspeed-ocp-rag-rhel9 (OpenShift Lightspeed) - A
Debian
CVE-2026-25990: pillow - Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bound...
vendor_debian·2026·CVSS 8.9
CVE-2026-25990 [HIGH] CVE-2026-25990: pillow - Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bound...
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 12.1.1-1)
sid: resolved (fixed in 12.1.1-1)
trixie: resolved (fixed in 11.1.0-5+deb13u1)
GHSA
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
ghsa·2026-05-04·CVSS 8.6
CVE-2026-42311 [HIGH] CWE-190 Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
### Impact
Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.
### Patches
Patched version: 12.2.0
Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.
### Workarounds
Use any version but affected versions: >= 10.
VulDB
python-pillow Pillow up to 12.1.0 PSD Image Parser out-of-bounds write (GHSA-cfh3-3jmp-rvhc / Nessus ID 298710)
vuldb·2026-04-15·CVSS 8.9
CVE-2026-25990 [HIGH] python-pillow Pillow up to 12.1.0 PSD Image Parser out-of-bounds write (GHSA-cfh3-3jmp-rvhc / Nessus ID 298710)
A vulnerability was found in python-pillow Pillow up to 12.1.0. It has been classified as critical. Impacted is an unknown function of the component PSD Image Parser. The manipulation leads to out-of-bounds write.
This vulnerability is documented as CVE-2026-25990. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
OSV
Pillow affected by out-of-bounds write when loading PSD images
osv·2026-02-11
CVE-2026-25990 [HIGH] Pillow affected by out-of-bounds write when loading PSD images
Pillow affected by out-of-bounds write when loading PSD images
### Impact
An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.
### Patches
Pillow 12.1.1 will be released shortly with a fix for this.
### Workarounds
`Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened.
### References
Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
GHSA
Pillow affected by out-of-bounds write when loading PSD images
ghsa·2026-02-11
CVE-2026-25990 [HIGH] CWE-787 Pillow affected by out-of-bounds write when loading PSD images
Pillow affected by out-of-bounds write when loading PSD images
### Impact
An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.
### Patches
Pillow 12.1.1 will be released shortly with a fix for this.
### Workarounds
`Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened.
### References
Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
OSV
CVE-2026-25990: Pillow is a Python imaging library
osv·2026-02-11·CVSS 8.9
CVE-2026-25990 [HIGH] CVE-2026-25990: Pillow is a Python imaging library
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
bugzilla·2026-02-11·CVSS 8.6
CVE-2026-25990 [HIGH] CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This is about Pillow.
Bugzilla
CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
bugzilla·2026-02-11·CVSS 7.5
CVE-2026-25990 [HIGH] CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
The CVE was reported against Pillow; this is a plugin *for* Pillow. It does not contain any code *from* Pillow.
Bugzilla
CVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
bugzilla·2026-02-11·CVSS 8.6
CVE-2026-25990 [HIGH] CVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
CVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Discussion:
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 10
Via RHSA-2026:6277 https://access.redhat.com/errata/RHSA-2026:6277
---
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Via RHSA-2026:6278 https://access.redhat.com/errata/RHSA-2026:6278
---
This issue has been addressed in the followin
Bugzilla
CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
bugzilla·2026-02-11·CVSS 8.6
CVE-2026-25990 [HIGH] CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
CVE-2026-25990 python-pypillowfight: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintain
Bugzilla
CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
bugzilla·2026-02-11·CVSS 8.6
CVE-2026-25990 [HIGH] CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
CVE-2026-25990 python-pillow-jxl-plugin: Pillow: Out-of-bounds Write via Specially Crafted PSD Image [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently main
Wiz
CVE-2026-25990 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.9
CVE-2026-25990 [HIGH] CVE-2026-25990 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25990 :
Python vulnerability analysis and mitigation
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Source : NVD
## 8.9
Score
Published February 11, 2026
Severity HIGH
CNA Score 8.9
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
tensorflow-cpu-jupyter
python3-pillow
Sources
NVD
Alpine 3.23, edge Severity HIGH Has Fix Added at: Feb 15, 2026
Chainguard Has Fix Added at: Feb 15, 2026
Debian 11, 12 No Fix Added at: Feb 12,
https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aahttps://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhchttp://www.openwall.com/lists/oss-security/2026/02/12/1https://access.redhat.com/errata/RHSA-2026:10184https://access.redhat.com/errata/RHSA-2026:14873https://access.redhat.com/errata/RHSA-2026:14874https://access.redhat.com/errata/RHSA-2026:16174https://access.redhat.com/errata/RHSA-2026:19712https://access.redhat.com/errata/RHSA-2026:28385https://access.redhat.com/errata/RHSA-2026:3461https://access.redhat.com/errata/RHSA-2026:3462https://access.redhat.com/errata/RHSA-2026:4128https://access.redhat.com/errata/RHSA-2026:4942https://access.redhat.com/errata/RHSA-2026:5168https://access.redhat.com/errata/RHSA-2026:5665https://access.redhat.com/errata/RHSA-2026:6277https://access.redhat.com/errata/RHSA-2026:6278https://access.redhat.com/errata/RHSA-2026:6308https://access.redhat.com/errata/RHSA-2026:6309https://access.redhat.com/errata/RHSA-2026:6497https://access.redhat.com/errata/RHSA-2026:6567https://access.redhat.com/errata/RHSA-2026:6568https://access.redhat.com/security/cve/CVE-2026-25990https://bugzilla.redhat.com/show_bug.cgi?id=2439170https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json
2026-02-11
Published