DEBIAN-CVE-2026-42311

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-42311

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42311.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-42311

Upstream

CVE-2026-42311

Published

2026-05-09T06:16:10.430Z

Modified

2026-05-21T22:00:09.409213387Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

References

https://security-tracker.debian.org/tracker/CVE-2026-42311

Affected packages

Debian:13 / pillow

Package

Name: pillow
Purl: pkg:deb/debian/pillow?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

11.*

11.1.0-5

11.1.0-5+deb13u1

11.1.0-5+deb13u2

11.2.1-1

11.3.0-1

12.*

12.0.0-1

12.1.0-1

12.1.1-1

12.1.1-2

12.2.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42311.json"

Debian:14 / pillow