---
schema_version: '1.0'
id: security-20260711-6ac13d
url: https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr
url_hash: 6ac13d1a91bb9f799b604f55e5201011764ccfe7892e52a87d2df4bc7f9a7bf1
canonical_url: https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42311
- GHSA-pwv6-vv43-88gr
- severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- pillow
- PyPI
lang: en
published_at: '2026-05-04T20:20:31Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:11Z'
status: published
content_hash: 4c97ed4f90bd2ac20a189e1b48e1f3222eb55ad0f4f9c9d2226e56ac681fc1ce
license_note: full
summary: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
summary_source: rss
summary_en: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
entities:
- name: HashTag
  type: concept
- name: Writer Ian Bogost
  type: person
key_facts: []
related: []
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
title: 'CVE-2026-42311: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer
  Overflow)'
---

# CVE-2026-42311: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

## TL;DR
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

## Key Points
- cve / CVE-2026-42311 / GHSA-pwv6-vv43-88gr / severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N / pillow / PyPI

## Details
**Severity:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
**Advisory:** GHSA-pwv6-vv43-88gr (CVE-2026-42311)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
### Impact
Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

### Patches
Patched version: 12.2.0

Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.

### Workarounds
Use any version but affected versions: >= 10.3.0, < 12.2.0

### Resources
 - Fix: https://github.com/python-pillow/Pillow/pull/9520 
 - Original issue: CVE-2026-25990 (Pillow 12.1.1)

**References:**
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr
- https://nvd.nist.gov/vuln/detail/CVE-2026-42311
- https://github.com/python-pillow/Pillow/pull/9520
- https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr_

## Source
元記事: [CVE-2026-42311: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)](https://osv.dev/vulnerability/GHSA-pwv6-vv43-88gr) — published 2026-05-04T20:20:31Z