CVE-2026-25990: Pillow Buffer Overflow Vulnerability

CVE-2026-25990 Overview

CVE-2026-25990 is an out-of-bounds write vulnerability affecting Pillow, the popular Python imaging library. The flaw exists in versions 10.3.0 through 12.1.0 and can be triggered when processing specially crafted PSD (Adobe Photoshop Document) image files. This vulnerability allows attackers to corrupt memory by exploiting improper validation of tile extents during image decoding, potentially leading to arbitrary code execution or application crashes.

Critical Impact

Attackers can exploit this vulnerability by delivering a malicious PSD file to applications using vulnerable Pillow versions, potentially achieving remote code execution or causing denial of service through memory corruption.

Affected Products

• Pillow versions 10.3.0 through 12.1.0
• Python applications utilizing vulnerable Pillow versions for image processing
• Web applications and services that process user-uploaded PSD images

Discovery Timeline

• 2026-02-11 - CVE CVE-2026-25990 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-25990

Vulnerability Analysis

This out-of-bounds write vulnerability (CWE-787) occurs within Pillow's PSD image decoder when processing tile extents. The vulnerability stems from insufficient validation of tile offset values during image decoding or encoding operations. When a specially crafted PSD file contains negative x or y offset values in tile extent definitions, the decoder fails to properly validate these boundaries before writing data to memory buffers.

The attack can be initiated remotely via network without requiring any privileges or user interaction. Applications that automatically process uploaded images or render PSD files from untrusted sources are particularly at risk. Successful exploitation could result in high impact to confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper input validation in the tile extent processing code path. Prior to the fix, Pillow's PSD decoder did not verify that tile extents use non-negative x and y offsets before performing write operations. This oversight allowed malformed PSD files to specify negative offsets that could cause writes outside the intended memory buffer boundaries.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft a malicious PSD file with invalid tile extents containing negative offset values. When this file is opened by an application using a vulnerable Pillow version, the out-of-bounds write is triggered during the image decoding process. Attack scenarios include:

1. Uploading malicious PSD files to web applications with image processing functionality
2. Sending crafted images via email or messaging platforms that auto-render previews
3. Hosting malicious images on websites visited by applications that fetch and process remote images

The security patch adds validation to check that tile extents do not use negative x or y offsets:

+12.1.1
+------
+
+Security
+========
+
+:cve:`2021-25289`: Fix OOB write with invalid tile extents
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Check that tile extents do not use negative x or y offsets when decoding or encoding,
+and raise an error if they do, rather than allowing an OOB write.
+
+An out-of-bounds write may be triggered when opening a specially crafted PSD image.
+This only affects Pillow >= 10.3.0. Reported by
+`Yarden Porat <https://github.com/yardenporat353>`__.
+
+Other changes
+=============
+
+Patch libavif for svt-av1 4.0 compatibility
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+A patch has been added to ``depends/install_libavif.sh``, to allow libavif 1.3.0 to be
+compatible with the recently released svt-av1 4.0.0.

Source: GitHub Commit Changes

Detection Methods for CVE-2026-25990

Indicators of Compromise

• Unexpected application crashes when processing PSD image files
• Memory corruption errors or segmentation faults in Python processes using Pillow
• Anomalous PSD files with unusual or malformed tile extent metadata
• Suspicious network activity involving PSD file transfers to image processing endpoints

Detection Strategies

• Monitor for crashes in applications processing PSD files and analyze crash dumps for out-of-bounds write patterns
• Implement file integrity monitoring on image upload directories to detect potentially malicious PSD files
• Use SentinelOne's behavioral AI to detect memory corruption exploitation attempts during image processing operations
• Deploy application-level logging to track PSD file processing events and correlate with system anomalies

Monitoring Recommendations

• Enable enhanced logging for image processing operations in web applications
• Configure alerts for unusual error rates in services handling image conversions
• Monitor Python application memory usage patterns for signs of memory corruption
• Implement network traffic analysis to detect unusual patterns of PSD file uploads

How to Mitigate CVE-2026-25990

Immediate Actions Required

• Upgrade Pillow to version 12.1.1 or later immediately across all environments
• Audit applications to identify all instances using Pillow versions 10.3.0 through 12.1.0
• Implement input validation to restrict processing of PSD files from untrusted sources until patched
• Review dependency manifests (requirements.txt, setup.py, pyproject.toml) to ensure version constraints exclude vulnerable releases

Patch Information

The vulnerability is fixed in Pillow version 12.1.1. The patch implements validation checks that ensure tile extents do not use negative x or y offsets during decoding or encoding operations. If invalid offsets are detected, an error is raised instead of allowing the out-of-bounds write to occur.

For detailed patch information, see the GitHub Security Advisory and the security commit.

Workarounds

• Disable PSD file processing entirely in applications where this format is not required
• Implement strict file type validation to reject PSD files from untrusted sources
• Deploy web application firewalls (WAF) with rules to block PSD file uploads pending patch deployment
• Isolate image processing services in sandboxed environments to limit exploitation impact

# Configuration example
# Upgrade Pillow to the patched version
pip install --upgrade "Pillow>=12.1.1"

# Verify installed version
python -c "import PIL; print(PIL.__version__)"

# Pin version in requirements.txt
echo "Pillow>=12.1.1" >> requirements.txt