Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/python3.12-pillow@12.1.1-1?arch=el9ap
purl pkg:rpm/redhat/python3.12-pillow@12.1.1-1?arch=el9ap
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-67yw-ej31-8ub1
Aliases:
CVE-2026-25990
GHSA-cfh3-3jmp-rvhc
Pillow affected by out-of-bounds write when loading PSD images ### Impact An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected. ### Patches Pillow 12.1.1 will be released shortly with a fix for this. ### Workarounds `Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened. ### References Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-24T12:25:04.435590+00:00 RedHat Importer Affected by VCID-67yw-ej31-8ub1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25990.json 38.4.0
2026-04-02T17:22:09.821611+00:00 RedHat Importer Affected by VCID-67yw-ej31-8ub1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25990.json 38.1.0
2026-04-01T13:31:29.925359+00:00 RedHat Importer Affected by VCID-67yw-ej31-8ub1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25990.json 38.0.0