PT-2026-7584 · Pillow+1 · Pillow+1

Yardenporat353 · CVE-2026-25990 · Published 2026-02-11 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.0

Description Pillow is a Python imaging library. An out-of-bounds write issue can occur when loading a specially crafted PSD image. This flaw exists within Pillow’s Photoshop Document (PSD) handler. The issue affects Pillow versions 10.3.0 and later.

Recommendations Update to Pillow version 12.1.1. As a workaround, use the formats parameter in Image.open() to prevent PSD images from being opened.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2026-05702

BIT-PILLOW-2026-25990

CLEANSTART-2026-EN66750

CLEANSTART-2026-FG72002

CLEANSTART-2026-RF67070

CVE-2026-25990

ECHO-B848-7C96-EE64

GHSA-CFH3-3JMP-RVHC

OPENSUSE-SU-2026:10198-1

OPENSUSE-SU-2026:20458-1

PYSEC-2026-2249

RHSA-2026:14873

RHSA-2026:14874

RHSA-2026:28385

RHSA-2026:6277

RHSA-2026:6278

SUSE-SU-2026:20992-1

USN-8047-1

Affected Products

Pillow

Red Os

References · 101

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25990.json · Exploit
• https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa · Patch
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20992-1 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-EN66750 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6277 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/728974 · Security Note
• https://access.redhat.com/errata/RHSA-2026:10184 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:42644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42308 · Security Note
• https://access.redhat.com/errata/RHSA-2026:3461 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/02/12/1 · Patch
• https://access.redhat.com/errata/RHSA-2026:4942 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:5665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25990 · Security Note