Every CVE Search/ Get API key

CVE-2026-25990

Pillow has an out-of-bounds write when loading PSD images

8.6 HighFix available

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.41%Up 0.4 points since Feb 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.6

Pillow has an out-of-bounds write when loading PSD images

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
CVE-2026-25990
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-787, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-6218 8.6

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
EUVD-2026-6218
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-cfh3-3jmp-rvhc 8.6

Pillow affected by out-of-bounds write when loading PSD images

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Record
GHSA-cfh3-3jmp-rvhc
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
NVD 8.6

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
CVE-2026-25990
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2026-25990 7.5

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
ALPINE-CVE-2026-25990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 8.6

Pillow has an out-of-bounds write when loading PSD images

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
CVE-2026-25990
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
Show 22 moreShow less
OSVDEBIAN-CVE-2026-25990 7.5

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
DEBIAN-CVE-2026-25990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-cfh3-3jmp-rvhc 8.6

Pillow affected by out-of-bounds write when loading PSD images

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Record
GHSA-cfh3-3jmp-rvhc
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
OSVOESA-2026-1477 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.(CVE-2026-25990)

Record
OESA-2026-1477
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1478 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.(CVE-2026-25990)

Record
OESA-2026-1478
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1479 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.(CVE-2026-25990)

Record
OESA-2026-1479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1480 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.(CVE-2026-25990)

Record
OESA-2026-1480
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-2249 7.5

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
PYSEC-2026-2249
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:14873 8.3

Red Hat Security Advisory: Satellite 6.17.8 Async Update

Record
RHSA-2026:14873
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:14874 8.3

Red Hat Security Advisory: Satellite 6.16.8 Async Update

Record
RHSA-2026:14874
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:28385 8.0

Red Hat Security Advisory: Satellite 6.18.6 Async Update

Record
RHSA-2026:28385
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6277 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:6277
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:6278 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:6278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-25990 7.5

CVE-2026-25990 in pillow - Patched by Root

Root has patched CVE-2026-25990 in the pillow package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-25990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-25990 8.6

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
UBUNTU-CVE-2026-25990
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-pillow-2026-25990 No score

Pillow has an out-of-bounds write when loading PSD images

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

Record
BIT-pillow-2026-25990
Updated
2026-11-02
OSVCLSA-2026-1774830261 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 10.4.0.post1+tuxcare.

Record
CLSA-2026-1774830261
Updated
2026-11-02
OSVCLSA-2026-1774830267 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.3.0.post1+tuxcare.

Record
CLSA-2026-1774830267
Updated
2026-11-02
OSVCLSA-2026-1786515922 No score

TuxCare security update for pillow (9 CVEs)

TuxCare rebuilt pillow to address 9 CVEs. Fixed in 11.2.1.post4+tuxcare.

Record
CLSA-2026-1786515922
Updated
2026-11-02
OSVopenSUSE-SU-2026:10198-1 No score

python311-Pillow-12.1.1-1.1 on GA media

These are all security issues fixed in the python311-Pillow-12.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10198-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20458-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-25990: Fixed an out-of-bounds write when opening a specially crafted PSD image. (bsc#1258125)
Record
openSUSE-SU-2026:20458-1
Updated
2026-11-02
OSVSUSE-SU-2026:20992-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2026-25990: Fixed an out-of-bounds write when opening a specially crafted PSD image. (bsc#1258125)
Record
SUSE-SU-2026:20992-1
Updated
2026-11-02
OSVUSN-8047-1 No score

pillow vulnerability

Yarden Porat discovered that Pillow incorrectly handled certain malformed PSD images. An attacker could use this issue to cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-8047-1
Updated
2026-11-02

Affected products

Show 16 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 10.3.0 up to 12.1.1
12.1.1
py3-pillow
Alpine:v3.23
 before 11.3.0-r2
11.3.0-r2
py3-pillow
Alpine:v3.24
 before 12.1.1-r0
12.1.1-r0
pillow
Bitnami
 10.3.0 up to 12.1.1
12.1.1
pillow
TuxCare:PyPI
 10.4.0 up to 10.4.0.post1+tuxcare
10.4.0.post1+tuxcare
pillow
TuxCare:PyPI
 11.3.0 up to 11.3.0.post1+tuxcare
11.3.0.post1+tuxcare
pillow
TuxCare:PyPI
From an advisory covering 9 CVEs
 11.2.1 up to 11.2.1.post4+tuxcare, plus listed versions
11.2.1.post1+tuxcare11.2.1.post2+tuxcare11.2.1.post3+tuxcare
11.2.1.post4+tuxcare
pillow
Debian:13
 before 11.1.0-5+deb13u1, plus listed versions
11.1.0-5
11.1.0-5+deb13u1
pillow
Debian:14
 before 12.1.1-1, plus listed versions
11.1.0-511.2.1-111.3.0-112.0.0-112.1.0-1
12.1.1-1
pillow
PyPI
 10.3.0 up to 12.1.1, plus listed versions
10.4.011.0.011.1.011.2.111.3.012.0.012.1.0
12.1.1
Show 94 moreShow less
Affected packages
PackageAffectedFixed
python-pillow
openEuler:24.03-LTS
 before 10.3.0-2.oe2403
10.3.0-2.oe2403
python-pillow
openEuler:24.03-LTS-SP1
 before 10.3.0-2.oe2403sp1
10.3.0-2.oe2403sp1
python-pillow
openEuler:24.03-LTS-SP2
 before 10.3.0-2.oe2403sp2
10.3.0-2.oe2403sp2
python-pillow
openEuler:24.03-LTS-SP3
 before 10.3.0-2.oe2403sp3
10.3.0-2.oe2403sp3
python-markdown
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python3.11-markdown
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python-markdown
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python3.11-markdown
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python-pillow
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pyOpenSSL
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:25.1.0-0.3.el9pc
0:25.1.0-0.3.el9pc
python3.11-pyOpenSSL
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:25.1.0-0.3.el9pc
0:25.1.0-0.3.el9pc
python-pyOpenSSL
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:25.1.0-0.3.el9pc
0:25.1.0-0.3.el9pc
python3.11-pyOpenSSL
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:25.1.0-0.3.el9pc
0:25.1.0-0.3.el9pc
candlepin
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el9sat
0:4.4.25-1.el9sat
candlepin-selinux
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el9sat
0:4.4.25-1.el9sat
rubygem-activesupport
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 5 CVEs
 before 0:7.0.8.7-2.el9sat
0:7.0.8.7-2.el9sat
rubygem-activesupport
Red Hat:satellite:6.17::el9
From an advisory covering 5 CVEs
 before 0:7.0.8.7-2.el9sat
0:7.0.8.7-2.el9sat
python-markdown
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el8pc
0:3.8.2-1.el8pc
python3.11-markdown
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el8pc
0:3.8.2-1.el8pc
python-markdown
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el8pc
0:3.8.2-1.el8pc
python3.11-markdown
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el8pc
0:3.8.2-1.el8pc
python-markdown
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python3.11-markdown
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python-markdown
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python3.11-markdown
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:3.8.2-1.el9pc
0:3.8.2-1.el9pc
python-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python3.11-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python-pillow
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python-pillow-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python3.11-pillow
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el8pc
0:12.1.1-1.el8pc
python-pillow
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pillow-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python-pyOpenSSL
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el8pc
0:24.1.0-2.el8pc
python3.11-pyOpenSSL
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el8pc
0:24.1.0-2.el8pc
python-pyOpenSSL
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el8pc
0:24.1.0-2.el8pc
python3.11-pyOpenSSL
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el8pc
0:24.1.0-2.el8pc
python-pyOpenSSL
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el9pc
0:24.1.0-2.el9pc
python3.11-pyOpenSSL
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el9pc
0:24.1.0-2.el9pc
python-pyOpenSSL
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el9pc
0:24.1.0-2.el9pc
python3.11-pyOpenSSL
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:24.1.0-2.el9pc
0:24.1.0-2.el9pc
candlepin
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el8sat
0:4.4.25-1.el8sat
candlepin-selinux
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el8sat
0:4.4.25-1.el8sat
candlepin
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el9sat
0:4.4.25-1.el9sat
candlepin-selinux
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:4.4.25-1.el9sat
0:4.4.25-1.el9sat
rubygem-activesupport
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 5 CVEs
 before 0:6.1.7.8-2.el8sat
0:6.1.7.8-2.el8sat
rubygem-activesupport
Red Hat:satellite:6.16::el8
From an advisory covering 5 CVEs
 before 0:6.1.7.8-2.el8sat
0:6.1.7.8-2.el8sat
rubygem-activesupport
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 5 CVEs
 before 0:6.1.7.8-2.el9sat
0:6.1.7.8-2.el9sat
rubygem-activesupport
Red Hat:satellite:6.16::el9
From an advisory covering 5 CVEs
 before 0:6.1.7.8-2.el9sat
0:6.1.7.8-2.el9sat
python3.12-pillow
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9pc
0:12.1.1-1.el9pc
candlepin
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:4.6.6-1.el9sat
0:4.6.6-1.el9sat
candlepin-selinux
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:4.6.6-1.el9sat
0:4.6.6-1.el9sat
dynflow-utils
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.0.1-1.el9sat
0:2.0.1-1.el9sat
dynflow-utils
Red Hat:satellite:6.18::el9
From an advisory covering 3 CVEs
 before 0:2.0.1-1.el9sat
0:2.0.1-1.el9sat
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:2.6.7-1.el9ap
0:2.6.7-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:12.1.1-1.el9ap
0:12.1.1-1.el9ap
python3.12-pillow-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:12.1.1-1.el9ap
0:12.1.1-1.el9ap
python3.12-pillow-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 7 CVEs
 before 0:12.1.1-1.el9ap
0:12.1.1-1.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-4.el8ap
0:2.5.10-4.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-4.el8ap
0:2.5.10-4.el8ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.14-1.el9
0:2.6.14-1.el9
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el8ap
0:12.1.1-1.el8ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:12.1.1-1.el9ap
0:12.1.1-1.el9ap
pillow
Root:PyPI
 before 10.3.0+aikido.2
10.3.0+aikido.211.3.0+aikido.212.1.0+aikido.312.1.0+aikido.410.4.0+aikido.110.4.0+aikido.211.0.0+aikido.110.3.0+aikido.311.1.0+aikido.111.3.0+aikido.511.1.0+aikido.410.4.0+aikido.311.0.0+aikido.211.1.0+aikido.210.3.0+aikido.411.3.0+aikido.311.1.0+aikido.310.4.0+aikido.410.3.0+aikido.511.3.0+aikido.411.0.0+aikido.310.3.0+aikido.610.4.0+aikido.511.0.0+aikido.412.1.0+aikido.511.1.0+aikido.510.3.0+aikido.711.0.0+aikido.510.4.0+aikido.611.3.0+aikido.612.1.0+aikido.611.0.0+aikido.610.3.0+aikido.810.4.0+aikido.711.1.0+aikido.611.3.0+aikido.710.4.0+aikido.811.2.1+aikido.111.0.0+aikido.711.1.0+aikido.711.2.1+aikido.212.1.0+aikido.710.3.0+aikido.910.3.0+aikido.1012.1.0+aikido.811.2.1+aikido.311.1.0+aikido.811.0.0+aikido.812.1.0+aikido.912.1.0+aikido.1010.3.0+aikido.1111.1.0+aikido.910.4.0+aikido.911.2.1+aikido.412.1.0+aikido.1111.1.0+aikido.1010.4.0+aikido.1011.0.0+aikido.910.3.0+aikido.1211.2.1+aikido.510.4.0+aikido.1112.1.0+aikido.1211.2.1+aikido.611.1.0+aikido.1111.0.0+aikido.1011.2.1+aikido.711.1.0+aikido.1211.3.0+aikido.810.4.0+aikido.1211.1.0+aikido.1312.1.0+aikido.1311.0.0+aikido.1110.4.0+aikido.1311.2.1+aikido.811.0.0+aikido.1211.1.0+aikido.1412.1.0+aikido.1411.3.0+aikido.910.4.0+aikido.1411.3.0+aikido.1011.1.0+aikido.1511.2.1+aikido.910.4.0+aikido.1512.1.0+aikido.1511.3.0+aikido.1111.0.0+aikido.1310.4.0+aikido.1610.4.0+aikido.1711.0.0+aikido.1410.4.0+aikido.18
python-Pillow
SUSE:Linux Enterprise Server 16.0
 before 11.3.0-160000.3.1
11.3.0-160000.3.1
python-Pillow
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 11.3.0-160000.3.1
11.3.0-160000.3.1
pillow
Ubuntu:25.10
 before 11.3.0-1ubuntu1.1, plus listed versions
11.1.0-5build111.3.0-1ubuntu1
11.3.0-1ubuntu1.1
python-Pillow
openSUSE:Tumbleweed
 before 12.1.1-1.1
12.1.1-1.1
python-Pillow
openSUSE:Leap 16.0
 before 11.3.0-160000.3.1
11.3.0-160000.3.1

History

History
RecordedChangedSources
affectedOSV
affected
affected, factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25990 is a high vulnerability (CVSS 8.6) in Python Pillow, published February 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in pillow 12.1.1.

References

Show 156 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open