CVE-2026-25990

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25990
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25990.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25990
Aliases
Downstream
ALPINE (1)
CGA (28)
CLEANSTART (6)
CLSA (3)
DEBIAN (1)
ECHO (1)
MINI (3)
OESA (4)
openSUSE (2)
RHSA (5)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2026-02-11T20:53:52Z
Modified
2026-10-28T11:09:52Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow has an out-of-bounds write when loading PSD images
Details

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25990.json"
}
References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
5c89d88eee199ba53f64581ea39b6a1bc52feb1a
Fixed
5158d98c807e719c5938aa3886913ef0ea6814e9
Fixed
9000313cc5d4a31bdcdd6d7f0781101abab553aa
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.3.0"
                },
                {
                    "fixed": "12.1.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "9000313cc5d4a31bdcdd6d7f0781101abab553aa"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

10.*
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25990.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "229877032534658977623741786717659447044",
                "319974852630686695120822858934520984635",
                "116638166775813595046580037362080071046",
                "215184650403678509934958989381934626184"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-25990-aee91039",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
        "target": {
            "file": "src/encode.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "234504920600121291969141422632203918330",
            "length": 1136
        },
        "id": "CVE-2026-25990-cbeaa7be",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
        "target": {
            "file": "src/encode.c",
            "function": "_setimage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "239855394713965671458712582677481759630",
                "306750425315581094017714380387831410748",
                "138410729778201785556805472567368274465",
                "25558607824357045323675274244141785619"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-25990-d050afcc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
        "target": {
            "file": "src/decode.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "270383409341186395449353466342428425790",
            "length": 1181
        },
        "id": "CVE-2026-25990-f5eda44c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa",
        "target": {
            "file": "src/decode.c",
            "function": "_setimage"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:09:52Z"