Pillow CVE-2026-42311
HIGH
GHSA-pwv6-vv43-88gr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5Blast Radius
ecosystem impact- 333 pypi packages depend on pillow (278 direct, 59 indirect)
Ecosystem-wide dependent count for version 10.3.0.
DescriptionGitHub Advisory
Impact
Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.
Patches
Patched version: 12.2.0
Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.
Workarounds
Use any version but affected versions: >= 10.3.0, < 12.2.0
Resources
- Fix: https://github.com/python-pillow/Pillow/pull/9520
- Original issue: CVE-2026-25990 (Pillow 12.1.1)
AnalysisAI
Integer overflow in Pillow 10.3.0 through 12.1.1 bypasses bounds checks during PSD tile extent validation, enabling memory corruption and arbitrary code execution when processing malicious PSD files. This vulnerability (CVE-2026-42311) exploits an incomplete fix for CVE-2026-25990, where the original patch added tile extent validation but used overflow-prone integer types. Attackers craft PSD images with tile dimensions that wrap around during extent sum calculations, defeating the bounds checks and triggering out-of-bounds writes in decode.c and encode.c. Pillow 12.2.0 patches this by avoiding extent addition before comparison. No active exploitation confirmed (not in CISA KEV); publicly available exploit code exists via proof-of-concept test images in the patch commit.
Technical ContextAI
Pillow is a Python Imaging Library (PIL) fork providing comprehensive image processing capabilities. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound) in the PSD (Adobe Photoshop Document) codec implementation. When processing PSD files, Pillow validates tile extents by computing sums of tile coordinates and dimensions to ensure they remain within image bounds. The flawed implementation in versions 10.3.0-12.1.1 used integer types susceptible to overflow when adding tile extents (e.g., xoff + xsize, yoff + ysize). Carefully chosen tile dimensions cause these sums to wrap around to small positive values or negative values that pass bounds checks, while the actual memory access attempts to write beyond allocated buffer boundaries in the C-level decode.c and encode.c modules. The affected package identifier is pkg:pip/pillow, impacting Python environments where Pillow handles untrusted PSD image input. The fix in PR #9520 restructures the validation logic to compare tile coordinates and sizes separately rather than computing potentially overflowing sums.
RemediationAI
Upgrade immediately to Pillow 12.2.0 or later, released with commit 58f9a1d166dcb0c274807d4423522d205b0c35ea applying the integer overflow fix from PR #9520 at https://github.com/python-pillow/Pillow/pull/9520. For Python environments, execute: pip install --upgrade pillow>=12.2.0 or update requirements.txt/pyproject.toml dependencies. Vendor advisory available at https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc and related GHSA-pwv6-vv43-88gr. If immediate upgrade is blocked by compatibility constraints, implement defense-in-depth compensating controls: (1) Use Image.open() with formats parameter to explicitly exclude PSD format (formats=['PNG', 'JPEG', 'GIF'] whitelist approach), trading PSD functionality for security. (2) Validate file magic bytes before processing and reject PSD headers (38 42 50 53 hex signature) at ingress points, though this prevents legitimate PSD usage. (3) Run Pillow image processing in sandboxed containers with restricted memory and no network access, limiting RCE impact but not preventing crashes. (4) Implement file size limits (reject PSD files >10MB) to constrain exploit delivery, though small crafted files may still trigger overflow. Note: Pillow versions 10.0.0-10.2.0 are NOT vulnerable to this specific integer overflow but may be vulnerable to the original CVE-2026-25990. Versions <10.3.0 predate the flawed tile extent validation code entirely. All workarounds sacrifice PSD format support; upgrade remains the only complete mitigation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today