NetSight
IP …
high8.6

CVE-2026-25990

Pillow affected by out-of-bounds write when loading PSD images

Impact

### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected. ### Patches Pillow 12.1.1 will be released shortly with a fix for this. ### Workarounds `Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened. ### References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Affected packages

EcosystemPackageAffectedFixed in
pippillow>= 10.3.0, < 12.1.112.1.1

Affected products

VendorProductAffected versions
PythonPillow
from 10.3.0 before 12.1.1

Weakness classification

CWE-787

References