Skip to content

fix(dependencies): update dependency pillow to v12 [security]#463

Closed
renovate[bot] wants to merge 1 commit intov7from
renovate/pypi-pillow-vulnerability
Closed

fix(dependencies): update dependency pillow to v12 [security]#463
renovate[bot] wants to merge 1 commit intov7from
renovate/pypi-pillow-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 11, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
Pillow (changelog) ==11.2.1==12.1.1 age confidence

GitHub Vulnerability Alerts

CVE-2026-25990

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html


BIT-pillow-2025-48379 / CVE-2025-48379 / GHSA-xg8h-j46f-w952 / PYSEC-2025-61

More information

Details

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

Severity

Unknown

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).


Pillow vulnerability can cause write buffer overflow on BCn encoding

BIT-pillow-2025-48379 / CVE-2025-48379 / GHSA-xg8h-j46f-w952 / PYSEC-2025-61

More information

Details

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.

This only affects users who save untrusted data as a compressed DDS image.

  • Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded.
  • Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.

This was introduced in Pillow 11.2.0 when the feature was added.

Severity

  • CVSS Score: Unknown
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


Pillow affected by out-of-bounds write when loading PSD images

BIT-pillow-2026-25990 / CVE-2026-25990 / GHSA-cfh3-3jmp-rvhc

More information

Details

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Severity

  • CVSS Score: Unknown
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


Release Notes

python-pillow/Pillow (Pillow)

v12.1.1

Compare Source

v12.1.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html

Deprecations
Documentation
Dependencies
Testing
Type hints
Other changes

v12.0.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.0.0.html

Removals

Deprecations

Documentation

Dependencies

Testing

Type hints

Other changes

v11.3.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/11.3.0.html

Deprecations

Documentation

Dependencies

Testing

Type hints

Other changes


Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

| datasource | package | from   | to     |
| ---------- | ------- | ------ | ------ |
| pypi       | pillow  | 11.2.1 | 12.1.1 |
@renovate renovate bot requested a review from EDM115 February 11, 2026 18:14
@github-actions github-actions bot added the PR: draft PR is draft. label Feb 11, 2026
@EDM115 EDM115 closed this Feb 23, 2026
@EDM115 EDM115 deleted the renovate/pypi-pillow-vulnerability branch February 23, 2026 15:04
@renovate
Copy link
Contributor Author

renovate bot commented Feb 23, 2026

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 12.x releases. But if you manually upgrade to 12.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant