CVE-2026-42311: Python Pillow

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Affected products

• Python Pillow: from 10.3.0, before 12.2.0 (fixed in 12.2.0)

Published 2026-05-09. Last modified 2026-07-24.