CVE-2026-25990 is an out-of-bounds write vulnerability (CWE-787) in the Pillow Python imaging library. It occurs when loading specially crafted PSD image files, potentially allowing memory corruption that could lead to arbitrary code execution or information disclosure. The vulnerability affects Pillow versions >=10.3.0 and <12.1.1. Red Hat's advisory confirms the issue and notes that mitigation options other than upgrading do not meet their criteria. The vulnerability has a high CVSS 4.0 score of 8.6, indicating significant impact if exploited. The fix is available in Pillow version 12.1.1 and corresponding updated packages in Red Hat products.

The vulnerability allows an attacker to trigger an out-of-bounds write, which can corrupt memory and potentially lead to arbitrary code execution or information disclosure. It may also cause denial of service through application crashes. The CVSS score of 8.6 (high severity) reflects the potential for significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A fix is available in Pillow version 12.1.1. Users should upgrade to this version or later to remediate the vulnerability. Red Hat has released updated packages addressing this issue in their distributions, including Red Hat Ansible Automation Platform 2.5. No effective mitigations other than upgrading are currently recommended by Red Hat. Users should apply the official patches or updates provided by their vendors.