https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:52:42 +0000 https://vulnerability.circl.lu/vuln/ghsa-pwv6-vv43-88gr <p><strong>Affected:</strong> PyPI: pillow</p> <p>### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.</p> <p>### Patches Patched version: 12.2.0</p> <p>Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.</p> <p>### Workarounds Use any version but affected versions: &gt;= 10.3.0, &lt; 12.2.0</p> <p>### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9520 - Original issue: CVE-2026-25990 (Pillow 12.1.1)</p> <p><strong>Affected:</strong> PyPI: pillow</p> <p>### Impact Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.</p> <p>### Patches Patched version: 12.2.0</p> <p>Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.</p> <p>### Workarounds Use any version but affected versions: &gt;= 10.3.0, &lt; 12.2.0</p> <p>### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9520 - Original issue: CVE-2026-25990 (Pillow 12.1.1)</p> https://vulnerability.circl.lu/vuln/ghsa-pwv6-vv43-88gr