CVE-2026-25990
📋 TL;DR
Pillow versions 10.3.0 through 12.1.0 contain an out-of-bounds write vulnerability when processing specially crafted PSD image files. This could allow attackers to execute arbitrary code or crash applications. Any Python application using Pillow to process untrusted PSD files is affected.
💻 Affected Systems
- Python Pillow (PIL Fork)
📦 What is this software?
Pillow by Python
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the vulnerable application runs with sufficient privileges.
Likely Case
Application crash (denial of service) or memory corruption leading to potential information disclosure.
If Mitigated
Limited impact if proper input validation and sandboxing prevent malicious PSD files from reaching vulnerable code.
🎯 Exploit Status
Requires attacker to supply a malicious PSD file to vulnerable application. No authentication bypass needed if application accepts file uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.1
Vendor Advisory: https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc
Restart Required: No
Instructions:
1. Update Pillow using pip: 'pip install --upgrade pillow==12.1.1' 2. Verify installation with 'pip show pillow' 3. Restart any running Python applications using Pillow
🔧 Temporary Workarounds
Disable PSD processing
allConfigure application to reject PSD files or use alternative image formats
Input validation
allImplement strict file type validation and size limits for uploaded images
🧯 If You Can't Patch
- Implement strict file upload validation to reject PSD files
- Run vulnerable applications in sandboxed/containerized environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check Pillow version with 'pip show pillow' or 'python -c "import PIL; print(PIL.__version__)"'Check Version:
python -c "import PIL; print(PIL.__version__)"Verify Fix Applied:
Confirm version is 12.1.1 or higher using version check command📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing PSD files
- Memory access violation errors in application logs
Network Indicators:
- Unusual PSD file uploads to web applications
- Multiple failed PSD processing attempts
SIEM Query:
source="application.log" AND ("segmentation fault" OR "memory error" OR "PSD")