CVE-2026-25990

What it actually does

This is a memory corruption flaw in Pillow’s PSD image parsing code affecting Pillow versions 10.3.0 through versions before 12.1.1. When Pillow loads a specially crafted Photoshop PSD file, malformed image structures can trigger an out-of-bounds write. At minimum, this can crash the process performing image parsing; depending on allocator behavior, platform hardening, and application context, memory corruption vulnerabilities may also create a path to arbitrary code execution within the privileges of the process that parses the image.

Why it matters to the business

Applications, services, batch jobs, or desktop tools that accept or process PSD uploads can be disrupted by a malicious image and may face deeper compromise if the memory corruption is exploitable in a given runtime. The highest-risk scenarios are internet-facing upload workflows, automated media-processing pipelines, document-management systems, and backend workers that process untrusted images. This issue is not currently listed in CISA KEV, has no known mature public exploit reported in the provided data, and has a low EPSS score, so urgency is lower than actively exploited vulnerabilities, but remediation is still important because image-parsing flaws are commonly reachable through normal business workflows.

How an attack unfolds

An attacker prepares a malformed PSD file designed to exercise the vulnerable Pillow parsing path. The attacker then places the file where a vulnerable application or worker will load it, such as an upload endpoint, media ingestion queue, document conversion flow, or local file-processing task. When Pillow parses the file, the crafted PSD triggers an out-of-bounds write. The likely observable result is a crash of the Python process, worker, or application component handling the file. In a more severe exploitation scenario, the attacker may attempt to shape memory corruption to execute code in the context of the affected process, which could allow access to files, secrets, network resources, or downstream systems available to that process.

How to fix it

Upgrade Pillow to version 12.1.1 or later wherever it is installed, including application virtual environments, containers, build images, serverless packages, desktop tooling, and transitive dependencies. Rebuild and redeploy applications after dependency updates so the fixed library is actually used at runtime. If using distribution-managed packages, apply the relevant vendor security update; the provided package metadata lists Debian 11 fixed package information as version 5.10.191-1 where applicable, but the Pillow-specific fixed version is 12.1.1, so confirm the authoritative package mapping for the deployed distribution. As interim mitigation, restrict or disable PSD uploads from untrusted users, validate file types before processing, run image conversion in a sandboxed low-privilege worker, enforce resource and timeout limits, and isolate media-processing workloads from sensitive credentials and internal networks.

How to confirm the fix worked

Confirm the installed Pillow version is 12.1.1 or later in every runtime that processes images. For Python environments, check with commands such as `python -m pip show Pillow`, `python -c "import PIL; print(PIL.__version__)"`, dependency lockfiles, SBOMs, and container image scans. For Debian-managed packages, verify the installed package versions with the system package manager and confirm the relevant vendor security advisory is applied. Validate that production builds, containers, and deployed artifacts were rebuilt after dependency updates rather than only updating source manifests. Test upload and processing workflows with benign PSD files to ensure functionality remains intact, and confirm untrusted PSD processing is either patched, blocked, or isolated.

Typical attack path

1. Identify an application, service, or workflow that processes PSD files using a vulnerable Pillow version.
2. Craft or obtain a malformed PSD file that triggers the out-of-bounds write during parsing.
3. Submit the PSD through an upload form, API, email attachment workflow, file share, queue, or other ingestion path.
4. Wait for the vulnerable Pillow-based process to load or validate the PSD image.
5. Trigger process crash, denial of service, or potentially memory-corruption-driven code execution depending on exploit reliability and runtime protections.
6. If code execution is achieved, operate with the privileges of the image-processing process and attempt credential access, lateral movement, or data access.

How to detect it

There are no unique public indicators of compromise provided for this vulnerability, and crashes from memory corruption may not leave a clear exploit signature. To assess possible prior exploitation, review application logs, upload audit logs, object storage access logs, API gateway logs, web server logs, worker queue telemetry, EDR events, and crash dumps for PSD files processed shortly before Python, Gunicorn, uWSGI, Celery, RQ, image-conversion workers, or other media-processing processes crashed or restarted. Look for unusual PSD uploads from new or low-reputation sources, repeated failed image-processing attempts, abnormally small or malformed PSD files, spikes in worker segmentation faults, and core dumps referencing Pillow or PSD parsing code. If crash dumps are available, inspect stack traces for Pillow PSD parser frames and correlate the triggering file hash, uploader/source IP, request path, and processing timestamp. Also review whether any affected process spawned unexpected child processes, made unusual outbound network connections, or accessed sensitive files after processing a PSD file, which would raise concern for exploitation beyond denial of service.

What your security team should do

• Inventory applications, containers, CI/CD images, and batch workers that include Pillow and process user-supplied or externally sourced images.
• Prioritize upgrades to Pillow 12.1.1 or later for internet-facing upload services and automated media-processing pipelines.
• Add dependency scanning rules to flag Pillow versions from 10.3.0 through versions before 12.1.1.
• Temporarily restrict PSD uploads or route them to a sandboxed converter until patching is complete.
• Run image-processing workloads with least privilege, no unnecessary secrets, constrained filesystem access, and limited outbound network access.
• Review recent crashes or restarts in image-processing services for malformed PSD activity, especially since publication on 2026-02-11.
• Ensure containers and serverless bundles are rebuilt and redeployed after updating dependency manifests or lockfiles.