Executive brief
Pillow, a widely used Python library for image processing, contains a vulnerability when handling Adobe Photoshop (PSD) files. If a user or automated system processes a specially crafted, malicious PSD file, it could cause the application to crash or allow an attacker to execute unauthorized code. This could lead to data theft or a complete takeover of the system running the software.
Technical details
An integer overflow vulnerability exists in the PSD image plugin of Pillow between versions 10.3.0 and 12.2.0. The flaw occurs when the library adds tile extents together without proper validation, leading to an out-of-bounds (OOB) write. An attacker can exploit this by providing a malicious PSD file that, when opened or processed, triggers memory corruption. This can result in a denial-of-service (crash) or arbitrary code execution in the context of the application. The vulnerability is addressed in version 12.2.0 by ensuring extents are not added together in a way that causes overflow.
Affected products
- python-pillow Pillow >= 10.3.0, < 12.2.0
Timeline
- 2026-04-01: patched: Fix committed and version 12.2.0 released.
- 2026-05-09: disclosed: Initial advisory published.