CVE-2026-42311 Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Attackers can trigger memory corruption and potential code execution by processing malicious PSD files in the Pillow library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42311?
CVE-2026-42311 is a high-severity vulnerability in Python Pillow, published on 9 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
Which versions are affected by CVE-2026-42311?
4 open source packages ship an affected version, including pillow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pillow Bitnami | From 10.3.0 | 12.2.0 |
pillow PyPI | From 10.3.0 | 12.2.0 |
pillow PyPI | From 10.3.0 | 12.2.0 |
pillow PyPI | From 10.3.0 | 12.2.0 |
Products include Python Pillow.
How do I fix CVE-2026-42311?
Upgrade pillow to 12.2.0 or later.
Is CVE-2026-42311 being exploited?
There is no known exploitation of CVE-2026-42311 in the wild and no public exploit code.
Other vulnerabilities in Python Pillow
Sources
Also known as BIT-pillow-2026-42311, CLEANSTART-2026-AG94767, CLEANSTART-2026-FR04537, CLSA-2026-1787244054, CLSA-2026-1790154692, CLSA-2026-1790239705 and 15 more.