Every CVE Search/ Get API key

CVE-2026-42311

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

8.6 HighFix available

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.15%Up 0.1 points since May 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.6

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
CVE-2026-42311
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-28903 8.6

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
EUVD-2026-28903
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pwv6-vv43-88gr 8.6

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Impact

Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

Patches

Patched version: 12.2.0

Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.

Workarounds

Use any version but affected versions: >= 10.3.0, < 12.2.0

Resources

Record
GHSA-pwv6-vv43-88gr
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-787
Updated
2026-11-02
NVD 8.6

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
CVE-2026-42311
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190, CWE-787
Updated
2026-11-02
OSV 8.6

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
CVE-2026-42311
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42311 7.8

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
DEBIAN-CVE-2026-42311
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVGHSA-pwv6-vv43-88gr 8.6

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Impact

Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

Patches

Patched version: 12.2.0

Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.

Workarounds

Use any version but affected versions: >= 10.3.0, < 12.2.0

Resources

Record
GHSA-pwv6-vv43-88gr
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-787
Updated
2026-11-02
OSVOESA-2026-2428 7.8

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

Record
OESA-2026-2428
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2429 7.8

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

Record
OESA-2026-2429
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2515 7.8

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

Record
OESA-2026-2515
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2026-2252 7.8

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
PYSEC-2026-2252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-42311 7.8

CVE-2026-42311 in pillow - Patched by Root

Root has patched CVE-2026-42311 in the pillow package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-42311
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-42311 8.6

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
UBUNTU-CVE-2026-42311
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-pillow-2026-42311 No score

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Record
BIT-pillow-2026-42311
Updated
2026-11-02
OSVCLSA-2026-1787244054 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.3.0.post4+tuxcare.

Record
CLSA-2026-1787244054
Updated
2026-11-02
OSVCLSA-2026-1790154692 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.2.1.post7+tuxcare.

Record
CLSA-2026-1790154692
Updated
2026-11-02
OSVCLSA-2026-1790239705 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 10.4.0.post8+tuxcare.

Record
CLSA-2026-1790239705
Updated
2026-11-02
OSVopenSUSE-SU-2026:11261-1 No score

python313-Pillow-12.3.0-1.1 on GA media

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11261-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21296-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues

  • CVE-2026-42311: malicious PSD file processing can lead to arbitrary code execution (bsc#1270404).
  • CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).
  • CVE-2026-54060: fonts can trigger excessive memory allocation during conversion or saving (bsc#1270410).
  • CVE-2026-55379: bypass of decompression bomb protection allows excessive memory allocation (bsc#1270411).
  • CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).
Record
openSUSE-SU-2026:21296-1
Updated
2026-11-02
OSVSUSE-SU-2026:22626-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues

  • CVE-2026-42311: malicious PSD file processing can lead to arbitrary code execution (bsc#1270404).
  • CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).
  • CVE-2026-54060: fonts can trigger excessive memory allocation during conversion or saving (bsc#1270410).
  • CVE-2026-55379: bypass of decompression bomb protection allows excessive memory allocation (bsc#1270411).
  • CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).
Record
SUSE-SU-2026:22626-1
Updated
2026-11-02
OSVUSN-8399-1 No score

pillow vulnerabilities

It was discovered that Pillow incorrectly handled large glyph advance values in fonts. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2026-42308)

It was discovered that Pillow incorrectly handled nested coordinate lists in certain APIs. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42309)

It was discovered that Pillow incorrectly handled certain malformed PDF files. An attacker could possibly use this issue to cause Pillow to use excessive resources, leading to a denial of service. (CVE-2026-42310)

It was discovered that Pillow incorrectly handled certain malformed PSD files. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42311)

Record
USN-8399-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 10.3.0 up to 12.2.0
12.2.0
pillow
Bitnami
 10.3.0 up to 12.2.0
12.2.0
pillow
TuxCare:PyPI
 11.3.0 up to 11.3.0.post4+tuxcare, plus listed versions
11.3.0.post1+tuxcare11.3.0.post2+tuxcare11.3.0.post3+tuxcare
11.3.0.post4+tuxcare
pillow
TuxCare:PyPI
 11.2.1 up to 11.2.1.post7+tuxcare, plus listed versions
11.2.1.post1+tuxcare11.2.1.post2+tuxcare11.2.1.post3+tuxcare11.2.1.post4+tuxcare11.2.1.post5+tuxcare11.2.1.post6+tuxcare
11.2.1.post7+tuxcare
pillow
TuxCare:PyPI
 10.4.0 up to 10.4.0.post8+tuxcare, plus listed versions
10.4.0.post1+tuxcare10.4.0.post2+tuxcare10.4.0.post3+tuxcare10.4.0.post4+tuxcare10.4.0.post5+tuxcare10.4.0.post6+tuxcare10.4.0.post7+tuxcare
10.4.0.post8+tuxcare
pillow
Debian:13
 before 11.1.0-5+deb13u3, plus listed versions
11.1.0-511.1.0-5+deb13u111.1.0-5+deb13u2
11.1.0-5+deb13u3
pillow
Debian:14
 before 12.2.0-1, plus listed versions
11.1.0-511.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-2
12.2.0-1
pillow
PyPI
 10.3.0 up to 12.2.0, plus listed versions
10.4.011.0.011.1.011.2.111.3.012.0.012.1.012.1.1
12.2.0
python-pillow
openEuler:24.03-LTS
 before 10.3.0-5.oe2403
10.3.0-5.oe2403
python-pillow
openEuler:24.03-LTS-SP3
 before 10.3.0-5.oe2403sp3
10.3.0-5.oe2403sp3
Show 13 moreShow less
Affected packages
PackageAffectedFixed
python-pillow
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 10.3.0-5.oe2403sp1
10.3.0-5.oe2403sp1
pillow
Root:PyPI
 before 10.3.0+aikido.2
10.3.0+aikido.212.1.0+aikido.312.1.0+aikido.410.4.0+aikido.211.0.0+aikido.110.3.0+aikido.311.1.0+aikido.111.1.0+aikido.410.4.0+aikido.311.0.0+aikido.211.1.0+aikido.210.3.0+aikido.411.1.0+aikido.310.4.0+aikido.410.3.0+aikido.511.0.0+aikido.310.3.0+aikido.610.4.0+aikido.511.0.0+aikido.412.1.0+aikido.511.1.0+aikido.510.3.0+aikido.711.0.0+aikido.510.4.0+aikido.612.1.0+aikido.611.0.0+aikido.610.3.0+aikido.810.4.0+aikido.711.1.0+aikido.610.4.0+aikido.811.2.1+aikido.111.0.0+aikido.711.1.0+aikido.711.2.1+aikido.212.1.0+aikido.710.3.0+aikido.910.3.0+aikido.1012.1.0+aikido.811.2.1+aikido.311.1.0+aikido.811.0.0+aikido.812.1.0+aikido.912.1.0+aikido.1010.3.0+aikido.1111.1.0+aikido.910.4.0+aikido.911.2.1+aikido.412.1.0+aikido.1111.1.0+aikido.1010.4.0+aikido.1011.0.0+aikido.910.3.0+aikido.1211.2.1+aikido.510.4.0+aikido.1112.1.0+aikido.1211.2.1+aikido.611.1.0+aikido.1110.3.0+aikido.1311.0.0+aikido.1011.2.1+aikido.711.1.0+aikido.1210.4.0+aikido.1211.1.0+aikido.1312.1.0+aikido.1310.3.0+aikido.1411.0.0+aikido.1110.3.0+aikido.1510.4.0+aikido.1311.2.1+aikido.811.0.0+aikido.1211.1.0+aikido.1412.1.0+aikido.1410.3.0+aikido.1610.4.0+aikido.1411.1.0+aikido.1511.2.1+aikido.910.4.0+aikido.1512.1.0+aikido.1510.3.0+aikido.1711.0.0+aikido.1310.4.0+aikido.1610.3.0+aikido.1810.3.0+aikido.1910.4.0+aikido.1710.3.0+aikido.2011.0.0+aikido.1410.4.0+aikido.18
python-Pillow
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 11.3.0-160000.6.1
11.3.0-160000.6.1
python-Pillow
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 11.3.0-160000.6.1
11.3.0-160000.6.1
pillow-python2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.2.1-3~build16.2.1-36.2.1-3ubuntu0.1~esm16.2.1-3ubuntu0.1~esm2
 None known
pillow
Ubuntu:25.10
 before 11.3.0-1ubuntu1.3, plus listed versions
11.1.0-5build111.3.0-1ubuntu111.3.0-1ubuntu1.111.3.0-1ubuntu1.2
11.3.0-1ubuntu1.3
pillow
Ubuntu:26.04:LTS
 before 12.1.1-2ubuntu1.2, plus listed versions
11.3.0-1ubuntu111.3.0-1ubuntu212.0.0-1ubuntu112.1.1-1ubuntu112.1.1-2ubuntu112.1.1-2ubuntu1.1
12.1.1-2ubuntu1.2
pillow
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 9.0.1-1ubuntu0.4, plus listed versions
8.1.2+dfsg-0.39.0.0-19.0.1-19.0.1-1build19.0.1-1ubuntu0.19.0.1-1ubuntu0.29.0.1-1ubuntu0.3
9.0.1-1ubuntu0.4
pillow
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 10.2.0-1ubuntu1.2, plus listed versions
10.0.0-110.1.0-110.2.0-110.2.0-1build110.2.0-1ubuntu1
10.2.0-1ubuntu1.2
pillow
Ubuntu:25.10
From an advisory covering 4 CVEs
 before 11.3.0-1ubuntu1.3, plus listed versions
11.1.0-5build111.3.0-1ubuntu111.3.0-1ubuntu1.111.3.0-1ubuntu1.2
11.3.0-1ubuntu1.3
pillow
Ubuntu:26.04:LTS
From an advisory covering 4 CVEs
 before 12.1.1-2ubuntu1.2, plus listed versions
11.3.0-1ubuntu111.3.0-1ubuntu212.0.0-1ubuntu112.1.1-1ubuntu112.1.1-2ubuntu112.1.1-2ubuntu1.1
12.1.1-2ubuntu1.2
python-Pillow
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 12.3.0-1.1
12.3.0-1.1
python-Pillow
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 11.3.0-160000.6.1
11.3.0-160000.6.1

History

History
RecordedChangedSources
affectedOSV
affected
affectedOSV
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42311 is a high vulnerability (CVSS 8.6) in Python Pillow, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in pillow 12.2.0.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open