PT-2026-37200 · Pypi · Pillow

Ethankim88 · Published 2026-05-04 · Updated 2026-05-22 · CVE-2026-42311

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.x

Description Processing a malicious PSD file can lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This occurs because bounds checks for tile extents in PSD image decoding and encoding used types susceptible to integer overflow. A PSD image with specifically crafted tile dimensions could cause values to wrap around, bypassing the checks and triggering an out-of-bounds write in the src/decode.c and src/encode.c files.

Recommendations Update to version 12.2.0.

Fix

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

BIT-PILLOW-2026-42311

CVE-2026-42311

ECHO-4895-DA6A-8B1F

GHSA-PWV6-VV43-88GR

OESA-2026-2428

OESA-2026-2429

Affected Products

Pillow

References · 22

• https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea · Patch
• https://github.com/python-pillow/Pillow/pull/9520 · Patch
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42311 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-42311 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2428 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42311 · Security Note
• https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42311 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-42311 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pillow-2026-42311 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2429 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42311 · Vendor Advisory
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 · Note