{"id":"CVE-2026-25990","title":"Pillow is a Python imaging library","summary":"Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-787"],"vendor":"python","product":"pillow","affected":["pillow >= 10.3.0, < 12.1.1"],"patched":["pillow 12.1.1"],"published":"2026-02-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:17:55.220","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990","references":[{"url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa","label":"security-advisories@github.com"},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc","label":"security-advisories@github.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/02/12/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14873","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14874","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3461","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3462","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4128","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4942","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5168","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5665","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6277","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6278","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6308","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6309","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6497","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6567","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25990","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439170","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25990"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"url":"https://github.com/python-pillow/Pillow/pull/9427"},{"url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"}],"tags":["nvd","cve.org","csaf","vex","red-hat","osv","pip"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-02-11T21:21:01.646207Z"},"scores":{"nvd":7.5,"cna":8.6,"vendor":7.3},"epss":0.00374,"epssPercentile":0.31151,"ingestedAt":"2026-07-01T15:50:58.574Z","aliases":["GHSA-cfh3-3jmp-rvhc","BIT-pillow-2026-25990","PYSEC-2026-2249"],"ecosystem":"pip","slug":"CVE-2026-25990","body":"## Overview\n\nPillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.\n\n## Affected\n\n- `pillow >= 10.3.0, < 12.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pillow 12.1.1`\n\n## Vendor advisories\n\n- **RHSA-2026:6278** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:6278)\n- **RHSA-2026:14874** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-05-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:14874)\n- **RHSA-2026:6277** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:6277)\n- **RHSA-2026:14873** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-05-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:14873)\n- **RHSA-2026:28385** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28385)\n- **RHSA-2026:4128** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-03-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:4128)\n- **RHSA-2026:3461** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3461)\n- **RHSA-2026:3462** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3462)\n- **RHSA-2026:16174** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:16174)\n- **RHSA-2026:6308** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:6308)\n- **RHSA-2026:6309** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:6309)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json)\n\n## Package advisory (CVE-2026-25990)\n\nAffected packages:\n\n- `pillow >= 10.3.0, < 12.1.1`\n\nPatched in:\n\n- `pillow 12.1.1`\n\nSource: https://osv.dev/vulnerability/GHSA-cfh3-3jmp-rvhc","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}