CVE-2026-25990: Pillow has an out-of-bounds write when loading PSD images
Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.
Patches Pillow 12.1.1 will be released shortly with a fix for this.
Workarounds Image.open() has a formats parameter that can be used to prevent PSD images from being opened.
References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Other sources
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
— MITRE
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 12.1.1 - Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.1.1 - Configuration
Use Pillow's Image.open() formats parameter to prevent PSD images from being opened (i.e., configure Image.open(formats=...) to disallow PSD).
Pillow (Image.open) formats parameter = exclude PSD by not including "PSD"
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25990?
CVE-2026-25990 is classified as a moderate severity vulnerability that allows for an out-of-bounds write.
How do I fix CVE-2026-25990?
To fix CVE-2026-25990, upgrade to Pillow version 12.1.1 or later.
Which versions of Pillow are affected by CVE-2026-25990?
CVE-2026-25990 affects Pillow versions between 10.3.0 and 12.1.0.
What type of vulnerability is CVE-2026-25990?
CVE-2026-25990 is an out-of-bounds write vulnerability triggered when loading a specially crafted PSD image.
Is there a workaround for CVE-2026-25990?
Yes, you can use the `formats` parameter in the `Image.open()` method to prevent handling of PSD images as a temporary workaround.