CVE-2026-42311

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.x

Description Processing a malicious PSD file can lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This occurs because bounds checks for tile extents in PSD image decoding and encoding used types susceptible to integer overflow. A PSD image with specifically crafted tile dimensions could cause values to wrap around, bypassing the checks and triggering an out-of-bounds write in the src/decode.c and src/encode.c files.

Recommendations Update to version 12.2.0.