GHSA-cfh3-3jmp-rvhc — Pillow affected by out-of-bounds write when loading PSD images

2026-09-29T00:29:18.280480+00:00

Affected: PyPI: pillow

### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

### Patches Pillow 12.1.1 will be released shortly with a fix for this.

### Workarounds `Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened.

### References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Most recent entries from all