| Package | Affected versions | Patched versions |
|---|---|---|
| pillow | ≥ 10.3.0, < 12.2.0 | 12.2.0 |
| pillow | ≥ 10.3.0, < 12.2.0 | 12.2.0 |
Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.
Patched version: 12.2.0
Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.
Use any version but affected versions: >= 10.3.0, < 12.2.0
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free