CVE-2026-25990

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.6EPSS <1%

Published 2026-02-11Updated 2026-04-30

Media 46

Vulnerability details

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

8.6

EPSS

<1%

Published

2026-02-11

Updated

2026-04-30

CNA

GitHub_M

Vendors

python-pillow

1 product

CPEs

cpe:/a:redhat:ansible_automation_platform:2.5::el8

cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8

cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8

cpe:/a:redhat:satellite:6.16::el8

cpe:/a:redhat:satellite_capsule:6.16::el8

cpe:/a:redhat:satellite_utils:6.16::el8

cpe:/a:redhat:ansible_automation_platform:2.5::el9

cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9

cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9

cpe:/a:redhat:ansible_automation_platform:2.6::el9

cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9

cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9

cpe:/a:redhat:satellite:6.16::el9

cpe:/a:redhat:satellite_capsule:6.16::el9

cpe:/a:redhat:satellite_utils:6.16::el9

cpe:/a:redhat:satellite:6.17::el9

cpe:/a:redhat:satellite_capsule:6.17::el9

cpe:/a:redhat:satellite_utils:6.17::el9

cpe:/a:redhat:satellite:6.18::el9

cpe:/a:redhat:satellite_capsule:6.18::el9

cpe:/a:redhat:satellite_maintenance:6.18::el9

cpe:/a:redhat:satellite_utils:6.18::el9

cpe:/a:redhat:ai_inference_server:3.2::el9

cpe:/a:redhat:ai_inference_server:3.3::el9

cpe:/a:redhat:openshift_ai:2.25::el9

cpe:/a:redhat:openshift_ai:3.3::el9

cpe:/a:redhat:quay:3.12::el8

cpe:/a:redhat:quay:3.15::el8

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:quay:3.10::el8

cpe:/a:redhat:quay:3.9::el8

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:ai_inference_server:3

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:satellite:6

cpe:/a:redhat:ansible_automation_platform:2.6::el10

cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10

cpe:/o:redhat:enterprise_linux:7

cpe:/o:redhat:enterprise_linux:8

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated