CVE-2026-42311

What it actually does

CVE-2026-42311 is a memory-corruption vulnerability in Pillow, the Python imaging library, affecting versions 10.3.0 through versions before 12.2.0 when parsing malicious Photoshop PSD image files. If a vulnerable application opens, converts, thumbnails, validates, or otherwise processes a crafted PSD, Pillow may corrupt process memory. The practical outcomes range from interpreter or worker-process crashes to potential arbitrary code execution in the context of the process using Pillow. Because Pillow is commonly embedded inside web applications, document-processing services, media pipelines, automation jobs, and file-ingestion workflows, the exposure depends on where PSD processing is reachable, especially from uploaded or externally supplied files.

Why it matters to the business

A successful attack can disrupt services that process images, causing crashes, failed uploads, broken thumbnail generation, queue backlogs, or outages in media-processing workflows. In a higher-impact scenario, exploitation could allow an attacker to run code with the privileges of the vulnerable application process, potentially leading to data access, tampering, lateral movement, or broader compromise. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity in the provided data, but it affects a widely used library and should be remediated during normal vulnerability-management cycles, with higher urgency for internet-facing or automated file-processing systems that accept PSD files from untrusted sources.

How an attack unfolds

An attacker prepares a malformed PSD file designed to trigger memory corruption in vulnerable Pillow versions. The attacker then gets an application to process that file, for example by uploading it to an image-upload feature, submitting it to a document-conversion workflow, placing it in a watched folder, sending it through an API that extracts image metadata, or convincing an automated job to process the file. When the vulnerable Pillow PSD parser reads the crafted content, memory corruption occurs. In the simplest outcome, the Python process or worker handling the image crashes, producing denial of service. If the memory-corruption condition is exploitable in the target runtime and deployment configuration, the attacker may be able to achieve arbitrary code execution under the privileges of the service account running the application. Exploitation is expected to be highly dependent on the exact Pillow version, Python runtime, operating system, compiler hardening, containerization, and how the application handles untrusted files.

How to fix it

Upgrade Pillow to version 12.2.0 or later wherever it is installed. Inventory Python environments, containers, virtual environments, serverless packages, build artifacts, and vendored dependencies because Pillow is often included indirectly by image-processing frameworks and application packages. If immediate upgrade is not possible, reduce exposure by blocking or disabling PSD processing from untrusted sources, validating file types before processing, isolating image processing in a low-privilege sandbox or container, enforcing resource limits, and ensuring worker processes do not run with access to sensitive credentials or broad filesystem permissions. Rebuild and redeploy container images or packaged applications after dependency updates; updating only the source manifest is insufficient if production artifacts still contain a vulnerable wheel or layer. Pin Pillow to a safe version and ensure dependency lockfiles are regenerated and reviewed.

How to confirm the fix worked

Confirm that every deployed Python environment using Pillow reports version 12.2.0 or later. Validate with package-manager checks such as `python -m pip show Pillow`, `python -c "import PIL; print(PIL.__version__)"`, SBOM scanning, container image scanning, and dependency-lockfile review. Search for vulnerable version ranges in `requirements.txt`, `requirements.lock`, `poetry.lock`, `Pipfile.lock`, `conda` environment files, container layers, and packaged application bundles. Exercise representative PSD-processing workflows after upgrade to confirm normal functionality. Where PSD ingestion is intentionally disabled, test that PSD uploads or PSD processing paths are rejected before reaching Pillow. For internet-facing services, verify that WAF, API gateway, or application-level validation rules cannot be bypassed by mismatched extensions, MIME types, archive contents, or renamed PSD files.

Typical attack path

1. Identify an application, API, job, or service that uses Pillow to process PSD files.
2. Confirm or infer that the deployed Pillow version is between 10.3.0 and before 12.2.0.
3. Craft or obtain a malicious PSD file that triggers the vulnerable parsing path.
4. Submit the PSD through an upload form, API endpoint, message queue, shared storage location, email attachment processor, or other file-ingestion path.
5. Wait for the application or background worker to open or transform the PSD using Pillow.
6. Trigger memory corruption during PSD parsing.
7. Cause a crash for denial of service or, if exploit conditions are favorable, execute attacker-controlled code in the context of the vulnerable process.
8. Use any gained execution to access local application data, credentials, downstream services, or to establish persistence, depending on process privileges and isolation controls.

How to detect it

To assess prior exploitation, review logs and artifacts from systems that processed PSD files while running Pillow 10.3.0 through before 12.2.0. Focus on upload, API gateway, web server, application, queue-worker, container runtime, process supervisor, and operating-system logs. Look for PSD uploads immediately followed by Python worker crashes, segmentation faults, abnormal exits, container restarts, failed thumbnail or conversion jobs, unexplained 500 responses, or repeated retries on the same image file. Correlate timestamps between file-ingestion events and process crashes. Preserve and inspect suspicious PSD files, especially files with a `.psd` extension or PSD magic bytes submitted shortly before crashes. Review core dumps, crash reports, and supervisor logs for references to Python, Pillow, PIL, or PSD parsing. If code execution is suspected, investigate the affected process account for unexpected child processes, outbound network connections, modified application files, new scheduled tasks, unusual shell execution, or credential access following the crash window. Because no public exploit indicators or threat actors are provided, detection should rely on behavioral correlation rather than fixed network or file signatures.

• PIL.PsdImagePlugin
• PsdImagePlugin
• Segmentation fault
• Fatal Python error
• core dumped
• SIGSEGV
• signal 11
• Worker exited unexpectedly
• worker process exited
• container restarted
• 8BPS

What your security team should do

• Prioritize upgrading Pillow to 12.2.0 or later in all applications and images that process user-supplied or externally sourced image files.
• Inventory all Python services, containers, CI/CD artifacts, serverless functions, and data-processing jobs for Pillow versions 10.3.0 through before 12.2.0.
• Identify file-ingestion paths that accept PSD files directly or indirectly, including uploads, APIs, message queues, shared storage, email processors, and batch jobs.
• Temporarily block PSD processing from untrusted sources if upgrades cannot be completed quickly.
• Run image-processing components with least privilege, restricted filesystem access, no unnecessary secrets, and strong process/container isolation.
• Add monitoring for crashes, worker restarts, abnormal exits, and suspicious PSD uploads around the period when vulnerable versions were deployed.
• Regenerate dependency lockfiles and rebuild production artifacts to ensure the patched library is actually present at runtime.
• Review SBOM and software-composition-analysis results for transitive Pillow usage in third-party packages.
• If crashes or suspicious PSD files are found, preserve samples, logs, container images, and core dumps for forensic analysis before cleanup.