PyPI/pillow CVE-2026-25990: high, EPSS 0.41%

Pillow affected by out-of-bounds write when loading PSD images

Action: Upgrade pillow to 12.1.1 or later.

pip install pillow==12.1.1

Affected

Fixed versions

Sources

• osv: GHSA-cfh3-3jmp-rvhc
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc
• https://nvd.nist.gov/vuln/detail/CVE-2026-25990
• https://github.com/python-pillow/Pillow/pull/9427
• https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199
• https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa
• https://github.com/python-pillow/Pillow
• https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html

CVE-2026-25990 · published 2026-02-11T14:22:50Z · modified 2026-09-10T03:50:59.393816085Z · JSON