8.6
High
CVE-2026-25990 Pillow is a Python imaging library
Description
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pillow 10.3 | 10.3.0 → < 12.1.1 | 12.1.1 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.16 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.17 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.18 for RHEL 9 | Versions not published | |
| Red Hat AI Inference Server 3.2 1772713830 | earliest → < 1772713830 | 1772713830 |
Show the 21 other branches Hide the 21 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AI Inference Server 3.3 1778244546 | earliest → < 1778244546 | 1778244546 |
| Red Hat Ansible Automation Platform 2.5 1774414699 | earliest → < 1774414699 | 1774414699 |
| Red Hat Ansible Automation Platform 2.6 1774417022 | earliest → < 1774417022 | 1774417022 |
| Red Hat OpenShift AI 2.25 1783998857 | earliest → < 1783998857 | 1783998857 |
| Red Hat OpenShift AI 3.3 1778600187 | earliest → < 1778600187 | 1778600187 |
| Red Hat Quay 3.12 1773771962 | earliest → < 1773771962 | 1773771962 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1775169226 | earliest → < 1775169226 | 1775169226 |
| Red Hat Quay 3.16 1775069491 | earliest → < 1775069491 | 1775069491 |
| Red Hat Quay 3.1 1773971077 | earliest → < 1773971077 | 1773971077 |
| Red Hat Quay 3.9 1773936323 | earliest → < 1773936323 | 1773936323 |
| OpenShift Lightspeed | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Quay 3.10 1773971077 | earliest → < 1773971077 | 1773971077 |
Other CVEs of Pillow
The 60 CVEs of Pillow →
CVE-2026-112902
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
8.3
High
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
6.3
Medium
CVE-2026-114501
Pillow is a Python imaging library
6.3
Medium
CVE-2026-96639
Pillow is a Python imaging library
9.8
Critical