PT-2026-7584 · Pillow+1 · Pillow+1

Yardenporat353 · Published 2026-02-11 · Updated 2026-05-22 · CVE-2026-25990

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.0

Description Pillow is a Python imaging library. An out-of-bounds write issue can occur when loading a specially crafted PSD image. This flaw exists within Pillow’s Photoshop Document (PSD) handler. The issue affects Pillow versions 10.3.0 and later.

Recommendations Update to Pillow version 12.1.1. As a workaround, use the formats parameter in Image.open() to prevent PSD images from being opened.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2026-05702

BIT-PILLOW-2026-25990

CVE-2026-25990

GHSA-CFH3-3JMP-RVHC

OPENSUSE-SU-2026:10198-1

OPENSUSE-SU-2026:20458-1

RHSA-2026:14873

RHSA-2026:14874

RHSA-2026:6277

RHSA-2026:6278

SUSE-SU-2026:20992-1

USN-8047-1

Affected Products

Pillow

Red Os

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25990.json · Exploit
• https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa · Patch
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10198-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8047-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05702 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25990 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25990 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20458-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25990 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20992-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25990 · Security Note
• http://openwall.com/lists/oss-security/2026/02/12/1 · Patch
• https://ubuntu.com/security/CVE-2026-25990 · Vendor Advisory