Log in Start free

Vulnerability · Published Feb 11, 2026 · Assigned by GitHub_M

CVE-2026-25990Pillow has an out-of-bounds write when loading PSD images

High 7.3

In plain English

A high-severity out-of-bounds write in Pillow from python-pillow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23py3-pillow11.3.0-r2ALPINE-CVE-2026-25990
Alpine:v3.24py3-pillow12.1.1-r0ALPINE-CVE-2026-25990
Debian:13pillow11.1.0-5+deb13u1DEBIAN-CVE-2026-25990
Debian:13pillow11.1.0-5+deb13u1DSA-6147-1
Debian:14pillow12.1.1-1DEBIAN-CVE-2026-25990
PyPIpillow12.1.1GHSA-cfh3-3jmp-rvhc
PyPIpillow12.1.1PYSEC-2026-2249
Ubuntu:25.10pillow11.3.0-1ubuntu1.1UBUNTU-CVE-2026-25990
Ubuntu:25.10pillow11.3.0-1ubuntu1.1USN-8047-1

Affected products (as reported)

VendorProductVersions
python-pillow Pillow >= 10.3.0, < 12.1.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References