Most recent entries from all

BIT-pillow-2026-25990 — Pillow has an out-of-bounds write when loading PSD images

Affected: Bitnami: pillow

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVE-2026-25990 — Pillow has an out-of-bounds write when loading PSD images

Affected: python-pillow Pillow, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3 and 17 more

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

GHSA-cfh3-3jmp-rvhc — Pillow affected by out-of-bounds write when loading PSD images

Affected: PyPI: pillow

### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

### Patches Pillow 12.1.1 will be released shortly with a fix for this.

### Workarounds `Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened.

### References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

PYSEC-2026-2249

Affected: PyPI: pillow

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.