PyPI/pillow CVE-2026-42311: high 7.8, EPSS 0.15%

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Action: Upgrade pillow to 12.2.0 or later.

pip install pillow==12.2.0

Affected

Fixed versions

Sources

• osv: GHSA-pwv6-vv43-88gr
• nvd: CVE-2026-42311
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr
• https://github.com/python-pillow/Pillow/pull/9520
• https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0

CVE-2026-42311 · published 2026-05-04T20:20:31Z · modified 2026-09-10T03:50:47.242104143Z · JSON