CVE-2026-42311
Fixed in a distro release EPSS <1%CVSS 8.6
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
Products: python-pillow Pillow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 12.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines-visualization-server | 2.16.1-r0 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | open-webui | 0.11.0-r0 |
| Chainguard | superset-6.0 | 6.0.0-r10 |
| Debian 13 | pillow | 11.1.0-5+deb13u3 |
| Debian 14 | pillow | 12.2.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-Pillow | 11.3.0-160000.6.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-Pillow | 11.3.0-160000.6.1 |
| Ubuntu 22.04 LTS | pillow | 9.0.1-1ubuntu0.4 |
| Ubuntu 24.04 LTS | pillow | 10.2.0-1ubuntu1.2 |
| Ubuntu 25.10 | pillow | 11.3.0-1ubuntu1.3 |
| Ubuntu 26.04 LTS | pillow | 12.1.1-2ubuntu1.2 |
| Ubuntu Pro 20.04 LTS | pillow-python2 | no fix |
| Wolfi | kubeflow-pipelines-visualization-server | 2.16.1-r0 |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | open-webui | 0.11.0-r0 |
| Wolfi | superset-6.0 | 6.0.0-r10 |
| openSUSE Leap 16.0 | python-Pillow | 11.3.0-160000.6.1 |
| openSUSE Tumbleweed | python-Pillow | 12.3.0-1.1 |