PT-2026-7584 · Pillow+1 · Pillow+1

Yardenporat353 · Published 2026-02-11 · Updated 2026-03-27 · CVE-2026-25990

Positive Technologies · (AI Summary)

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.0

Description Pillow is a Python imaging library. An out-of-bounds write issue can occur when loading a specially crafted PSD image. This flaw exists within Pillow’s Photoshop Document (PSD) handler. The issue affects Pillow versions 10.3.0 and later.

Recommendations Update to Pillow version 12.1.1. As a workaround, use the formats parameter in Image.open() to prevent PSD images from being opened.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-PILLOW-2026-25990

CVE-2026-25990

GHSA-CFH3-3JMP-RVHC

OPENSUSE-SU-2026:10198-1

RHSA-2026:6277

RHSA-2026:6278

USN-8047-1

Affected Products

Pillow

Red Os

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25990.json · Exploit
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc · Vendor Advisory
• https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa · Patch
• http://openwall.com/lists/oss-security/2026/02/12/1 · Patch
• https://ubuntu.com/security/CVE-2026-25990 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10198-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8047-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cfh3-3jmp-rvhc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-25990 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/728974 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25990 · Security Note