Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

Pillow library can let attackers run code

CVE-2026-25990 · published 2 days ago
Summary

The Python Pillow imaging library contains a flaw that could allow a specially crafted image to execute code on the system. This affects Pillow packages from the listed distributors. Install the newest Pillow version that includes the fix to protect your systems.

What to do
  • Update jeffrey 'alex' clark pillow to version 12.1.1.
  • Update jeffrey 'alex' clark pillow to version 11.0.0+aikido.11.
  • Update rootio-pillow to version 12.1.0+root.io.1.
  • Update debian pillow to version 11.1.0-5+deb13u1.
  • Update debian pillow to version 12.1.1-1.
  • Update rootio-pillow to version 12.1.0+root.io.2.
  • Update rootio-pillow to version 10.4.0+root.io.2.
  • Update jeffrey 'alex' clark pillow to version 10.4.0+aikido.2.
  • Update rootio-pillow to version 11.0.0+root.io.1.
  • Update jeffrey 'alex' clark pillow to version 11.0.0+aikido.1.
  • Update canonical pillow to version 11.3.0-1ubuntu1.1.
  • Update rootio-pillow to version 10.3.0+root.io.3.
  • Update jeffrey 'alex' clark pillow to version 10.3.0+aikido.3.
  • Update rootio-pillow to version 11.1.0+root.io.1.
  • Update jeffrey 'alex' clark pillow to version 11.1.0+aikido.1.
  • Update rootio-pillow to version 11.3.0+root.io.6.
  • Update rootio-pillow to version 10.4.0+root.io.8.
  • Update rootio-pillow to version 11.2.1+root.io.1.
  • Update rootio-pillow to version 11.2.1+root.io.2.
  • Update rootio-pillow to version 12.1.0+root.io.8.
  • Update jeffrey 'alex' clark pillow to version 10.3.0+aikido.11.
  • Update jeffrey 'alex' clark pillow to version 11.2.1+aikido.4.
  • Update jeffrey 'alex' clark pillow to version 10.4.0+aikido.12.
  • Update pillow to version 11.1.0+aikido.14.
  • Update pillow to version 11.3.0+aikido.9.
  • Update pillow to version 10.4.0+aikido.14.
  • Update pillow to version 11.3.0+aikido.10.
  • Update pillow to version 11.1.0+aikido.15.
  • Update pillow to version 11.2.1+aikido.9.
  • Update pillow to version 12.1.0+aikido.15.
  • Update pillow to version 11.3.0+aikido.11.
  • Update pillow to version 11.0.0+aikido.13.
  • Update pillow to version 10.4.0+aikido.16.
  • Update pillow to version 11.0.0+aikido.14.
  • Update pillow to version 10.4.0+aikido.18.
  • Update python pillow to version 12.1.1 or later.
Affected software
Ecosystem VendorProductAffected versions
pip jeffrey 'alex' clark pillow >= 10.3.0, < 12.1.1
Fix: upgrade to 12.1.1
– python pillow >= 10.3.0, < 12.1.1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
Root:PyPI jeffrey 'alex' clark pillow < 11.0.0+aikido.11
< 10.4.0+aikido.2
< 11.0.0+aikido.1
< 10.3.0+aikido.3
< 11.1.0+aikido.1
< 10.3.0+aikido.11
< 11.2.1+aikido.4
< 10.4.0+aikido.12
Fix: upgrade to 11.0.0+aikido.11
Root:PyPI – rootio-pillow < 12.1.0+root.io.1
< 12.1.0+root.io.2
< 10.4.0+root.io.2
< 11.0.0+root.io.1
< 10.3.0+root.io.3
< 11.1.0+root.io.1
< 11.3.0+root.io.6
< 10.4.0+root.io.8
< 11.2.1+root.io.1
< 11.2.1+root.io.2
< 12.1.0+root.io.8
Fix: upgrade to 12.1.0+root.io.1
Debian:13 debian pillow < 11.1.0-5+deb13u1
Fix: upgrade to 11.1.0-5+deb13u1
Debian:14 debian pillow < 12.1.1-1
Fix: upgrade to 12.1.1-1
Ubuntu:25.10 canonical pillow < 11.3.0-1ubuntu1.1
Fix: upgrade to 11.3.0-1ubuntu1.1
– python-pillow pillow >= 10.3.0, < 12.1.1
Root:PyPI – pillow < 11.1.0+aikido.14
< 11.3.0+aikido.9
< 10.4.0+aikido.14
< 11.3.0+aikido.10
< 11.1.0+aikido.15
< 11.2.1+aikido.9
< 12.1.0+aikido.15
< 11.3.0+aikido.11
< 11.0.0+aikido.13
< 10.4.0+aikido.16
< 11.0.0+aikido.14
< 10.4.0+aikido.18
Fix: upgrade to 11.1.0+aikido.14
Original advisory text
CVE-2026-25990 in pillow - Patched by Root
Root has patched CVE-2026-25990 in the pillow package for Root:PyPI. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published6 Nov 2026
Updated7 Nov 2026
First seen6 Mar 2026
Sources
ROOT-APP-PYPI-CVE-2026-25990 · OSV
DEBIAN-CVE-2026-25990 · OSV
UBUNTU-CVE-2026-25990 · OSV
CVE-2026-25990 · NVD
GHSA-cfh3-3jmp-rvhc · GHSA
CVE-2026-25990 · OSV
BIT-pillow-2026-25990 · OSV
GHSA-cfh3-3jmp-rvhc · OSV
CVE-2026-25990 · MITRE
Track software like this
Free during beta