CVE-2026-25990
Fixed in a distro release EPSS <1%CVSS 8.6
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
Products: python-pillow Pillow, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.9, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines-visualization-server | 2.15.0-r5 |
| Chainguard | label-studio | 1.22.0-r4 |
| Chainguard | litellm | 1.81.12.1-r0 |
| Chainguard | mlflow | 3.9.0-r1 |
| Chainguard | mlflow-iamguarded-compat | 3.9.0-r1 |
| Chainguard | open-webui | 0.11.0-r0 |
| Chainguard | open-webui | 0.8.3-r1 |
| Chainguard | pgadmin4 | 9.12-r1 |
| Chainguard | pgadmin4-fips | 9.12-r1 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0.16.0-r0 |
| Chainguard | py3.11-text-generation-inference | 3.3.7-r7 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0.16.0-r0 |
| Chainguard | superset-5.0 | 5.0.0-r17 |
| Chainguard | superset-6.0 | 6.0.0-r2 |
| Chainguard | tensorflow-cpu-jupyter | 2.20.0-r11 |
| Chainguard | tensorflow-gpu-jupyter | 2.20.0-r10 |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | 25.9.0_git20251112-r7 |
| Chainguard | vllm-openai-cuda-12.9 | 0.15.1-r0 |
| Debian 13 | pillow | 11.1.0-5+deb13u1 |
| Debian 14 | pillow | 12.1.1-1 |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy | 0:2.5.10-4.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.5.10-4.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.1.1-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.1.1-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-debugsource | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server-debuginfo | 0:2.6.14-1.el9 |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow | 0:12.1.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debuginfo | 0:12.1.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debugsource | 0:12.1.1-1.el9ap |
| Red Hat satellite 6.16 | candlepin | 0:4.4.25-1.el9sat |
| Red Hat satellite 6.16 | candlepin | 0:4.4.25-1.el8sat |
| Red Hat satellite 6.16 | candlepin-selinux | 0:4.4.25-1.el8sat |
| Red Hat satellite 6.16 | candlepin-selinux | 0:4.4.25-1.el9sat |
| Red Hat satellite 6.16 | python-markdown | 0:3.8.2-1.el8pc |
| Red Hat satellite 6.16 | python-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite 6.16 | python-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.16 | python-pillow | 0:12.1.1-1.el8pc |
| Red Hat satellite 6.16 | python-pillow-debugsource | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.16 | python-pillow-debugsource | 0:12.1.1-1.el8pc |
| Red Hat satellite 6.16 | python-pyOpenSSL | 0:24.1.0-2.el8pc |
| Red Hat satellite 6.16 | python-pyOpenSSL | 0:24.1.0-2.el9pc |
| Red Hat satellite 6.16 | python3.11-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite 6.16 | python3.11-markdown | 0:3.8.2-1.el8pc |
| Red Hat satellite 6.16 | python3.11-pillow | 0:12.1.1-1.el8pc |
| Red Hat satellite 6.16 | python3.11-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.16 | python3.11-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.16 | python3.11-pillow-debuginfo | 0:12.1.1-1.el8pc |
| Red Hat satellite 6.16 | python3.11-pyOpenSSL | 0:24.1.0-2.el9pc |
| Red Hat satellite 6.16 | python3.11-pyOpenSSL | 0:24.1.0-2.el8pc |
| Red Hat satellite 6.16 | rubygem-activesupport | 0:6.1.7.8-2.el9sat |
| Red Hat satellite 6.16 | rubygem-activesupport | 0:6.1.7.8-2.el8sat |
| Red Hat satellite 6.17 | candlepin | 0:4.4.25-1.el9sat |
| Red Hat satellite 6.17 | candlepin-selinux | 0:4.4.25-1.el9sat |
| Red Hat satellite 6.17 | python-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite 6.17 | python-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.17 | python-pillow-debugsource | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.17 | python-pyOpenSSL | 0:25.1.0-0.3.el9pc |
| Red Hat satellite 6.17 | python3.11-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite 6.17 | python3.11-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.17 | python3.11-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.17 | python3.11-pyOpenSSL | 0:25.1.0-0.3.el9pc |
| Red Hat satellite 6.17 | rubygem-activesupport | 0:7.0.8.7-2.el9sat |
| Red Hat satellite 6.18 | candlepin | 0:4.6.6-1.el9sat |
| Red Hat satellite 6.18 | candlepin-selinux | 0:4.6.6-1.el9sat |
| Red Hat satellite 6.18 | dynflow-utils | 0:2.0.1-1.el9sat |
| Red Hat satellite 6.18 | python3.12-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.18 | python3.12-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite 6.18 | python3.12-pillow-debugsource | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.16 | python-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite capsule 6.16 | python-markdown | 0:3.8.2-1.el8pc |
| Red Hat satellite capsule 6.16 | python-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.16 | python-pillow | 0:12.1.1-1.el8pc |
| Red Hat satellite capsule 6.16 | python-pillow-debugsource | 0:12.1.1-1.el8pc |
| Red Hat satellite capsule 6.16 | python-pillow-debugsource | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.16 | python-pyOpenSSL | 0:24.1.0-2.el9pc |
| Red Hat satellite capsule 6.16 | python-pyOpenSSL | 0:24.1.0-2.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-markdown | 0:3.8.2-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-pillow | 0:12.1.1-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-pillow-debuginfo | 0:12.1.1-1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-pyOpenSSL | 0:24.1.0-2.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-pyOpenSSL | 0:24.1.0-2.el8pc |
| Red Hat satellite capsule 6.16 | rubygem-activesupport | 0:6.1.7.8-2.el9sat |
| Red Hat satellite capsule 6.16 | rubygem-activesupport | 0:6.1.7.8-2.el8sat |
| Red Hat satellite capsule 6.17 | python-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite capsule 6.17 | python-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.17 | python-pillow-debugsource | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.17 | python-pyOpenSSL | 0:25.1.0-0.3.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-markdown | 0:3.8.2-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-pyOpenSSL | 0:25.1.0-0.3.el9pc |
| Red Hat satellite capsule 6.17 | rubygem-activesupport | 0:7.0.8.7-2.el9sat |
| Red Hat satellite capsule 6.18 | dynflow-utils | 0:2.0.1-1.el9sat |
| Red Hat satellite capsule 6.18 | python3.12-pillow | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-pillow-debuginfo | 0:12.1.1-1.el9pc |
| Red Hat satellite capsule 6.18 | python3.12-pillow-debugsource | 0:12.1.1-1.el9pc |
| SUSE Linux Enterprise Server 16.0 | python-Pillow | 11.3.0-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Pillow | 11.3.0-160000.3.1 |
| Ubuntu 25.10 | pillow | 11.3.0-1ubuntu1.1 |
| Wolfi | kubeflow-pipelines-visualization-server | 2.15.0-r5 |
| Wolfi | mlflow | 3.9.0-r1 |
| Wolfi | mlflow-iamguarded-compat | 3.9.0-r1 |
| Wolfi | open-webui | 0.8.3-r1 |
| Wolfi | open-webui | 0.11.0-r0 |
| Wolfi | superset-5.0 | 5.0.0-r17 |
| Wolfi | superset-6.0 | 6.0.0-r2 |
| openSUSE Leap 16.0 | python-Pillow | 11.3.0-160000.3.1 |
| openSUSE Tumbleweed | python-Pillow | 12.1.1-1.1 |