PSD tile extents overflow Pillow's bounds check and write out of bounds
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
- Advisory
- CVE-2026-42311
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- not scored upstream
- Affected
- >= 10.3.0, < 12.2.0
- Fixed in
- 12.2.0
- Reaches you
- by opening a file
What triggers it
Image.open on a Photoshop (PSD) file with tile dimensions chosen to wrap the extent sum.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A Photoshop file is refused by name before Pillow sees it, as for CVE-2026-25990, whose fix this bypassed.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 12.2.0.
Specifically. Open with formats limited to the readers you mean to use, as open_checked does.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr
- https://osv.dev/vulnerability/PYSEC-2026-2252
- The record entry, triaged 2026-11-03, last checked 2026-11-03