Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Pillow: Malicious PSD files can crash or run code

published 5 months ago

Summary

Pillow, a library used for image processing in Python, has a security issue that can cause a program to crash or allow unauthorized code to run if it processes a specially crafted PSD file. This issue has been fixed in version 12.2.0. You should update to this version or later to ensure your system is secure.

What to do

Update openeuler python-pillow to version 10.3.0-5.oe2403sp3.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP3	openeuler	python-pillow	< 10.3.0-5.oe2403sp3 Fix: upgrade to 10.3.0-5.oe2403sp3

Original advisory text

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42311 Vendor Advisory

Severity

7.8 High

Timeline

Published22 May 2026

Updated21 Aug 2026

First seen22 May 2026

Sources

OESA-2026-2429 · OSV

Track software like this

Free during beta