A crafted PSD file writes out of bounds when Pillow loads it
Pillow affected by out-of-bounds write when loading PSD images
- Advisory
- CVE-2026-25990
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- not scored upstream
- Affected
- >= 10.3.0, < 12.1.1
- Fixed in
- 12.1.1
- Reaches you
- by opening a file
What triggers it
Image.open on a Photoshop (PSD) file with crafted layer data, then loading it.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A Photoshop file is not one of the four formats a scan can be and is refused by name before Pillow sees it; the advisory's own workaround is Image.open's formats parameter, which open_checked sets from the policy.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 12.1.1.
Specifically. Open with formats limited to the readers you mean to use, as open_checked does; sillybos refuses a Photoshop file by name by default.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-cfh3-3jmp-rvhc
- https://osv.dev/vulnerability/PYSEC-2026-2249
- The record entry, triaged 2026-11-03, last checked 2026-11-03