CVE-2026-25990 — Out-of-bounds Write in Pillow

CWE-787 — Out-of-bounds Write10 documents9 sources
Severity
8.9HIGHNVD
EPSS
0.0%
top 95.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Python PillowPython-pillow Pillow
Timeline
PublishedFeb 11
Latest updateApr 15

Description

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDpython/pillow10.3.0 — 12.1.1
▶PyPIpython/pillow10.3.0 — 12.1.1
▶Debianpython/pillow< 11.1.0-5+deb13u1+1
▶CVEListV5python-pillow/pillow>= 10.3.0, < 12.1.1

Patches

Patch: github.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

5
VulDB
python-pillow Pillow up to 12.1.0 PSD Image Parser out-of-bounds write (GHSA-cfh3-3jmp-rvhc / Nessus ID 298710)↗2026-04-15
▶
OSV
Pillow affected by out-of-bounds write when loading PSD images↗2026-02-11
▶
CVEList
Pillow has an out-of-bounds write when loading PSD images↗2026-02-11
▶
GHSA
Pillow affected by out-of-bounds write when loading PSD images↗2026-02-11
▶
OSV
CVE-2026-25990: Pillow is a Python imaging library↗2026-02-11
▶

📋Vendor Advisories

3
Ubuntu
Pillow vulnerability↗2026-02-17
▶
Red Hat
pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image↗2026-02-11
▶
Debian
CVE-2026-25990: pillow - Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bound...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-25990 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-25990 — Out-of-bounds Write in Python Pillow | cvebase