p PatchFirst

CVE-2026-25990

CVE-2026-25990 · Pillow has an out-of-bounds write when loading PSD images

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVSS 8.6 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pillow

    Versions
    • >= 10.3.0, < 12.1.1: Affected

    No fix published

  • pillow Debian:13

    Versions
    • 11.1.0-5
    Affected ranges
    • ECOSYSTEM: < 11.1.0-5+deb13u1

    Update to 11.1.0-5+deb13u1

  • pillow Debian:14

    Versions
    • 11.1.0-5
    • 11.2.1-1
    • 11.3.0-1
    • 12.0.0-1
    • 12.1.0-1
    Affected ranges
    • ECOSYSTEM: < 12.1.1-1

    Update to 12.1.1-1

  • pillow PyPI

    Versions
    • 10.3.0
    • 10.4.0
    • 11.0.0
    • 11.1.0
    • 11.2.1
    • 11.3.0
    • 12.0.0
    • 12.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 10.3.0, < 12.1.1

    Update to 12.1.1

  • pillow Ubuntu:25.10

    Versions
    • 11.1.0-5build1
    • 11.3.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 11.3.0-1ubuntu1.1

    Update to 11.3.0-1ubuntu1.1

Original sources

Check your server →