CVE-2026-42311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42311
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42311.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-42311
Aliases
Downstream
CGA (6)
CLEANSTART (6)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (7)
OESA (3)
openSUSE (2)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
openSUSE (2)
SUSE (1)
Published
2026-05-09T04:11:58Z
Modified
2026-08-12T03:30:45Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Details

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-190",
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42311.json"
}
References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
5c89d88eee199ba53f64581ea39b6a1bc52feb1a
Fixed
3c41c095064200a02672d89cc5ff629eaf4b0d4f
Fixed
58f9a1d166dcb0c274807d4423522d205b0c35ea
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "10.3.0"
        },
        {
            "fixed":  "12.2.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

10.*
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42311.json"