Summary
Yarden Porat discovered that Pillow incorrectly handled certain malformed
PSD images. An attacker could use this issue to cause Pillow to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | pillow | 11.3.0-1ubuntu1.1 |
Vulnerabilities 1
-
High 8.6
Pillow has an out-of-bounds write when loading PSD images
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
References
-
report
https://ubuntu.com/security/CVE-2026-25990