CVE-2026-25990 is an out-of-bounds write vulnerability (CWE-787) in the Pillow Python imaging library. It can be triggered by loading a specially crafted PSD image in Pillow versions >=10.3.0 and <12.1.1. This vulnerability allows memory corruption due to improper bounds checking during PSD image processing. The issue is resolved in Pillow version 12.1.1. Red Hat has released security advisories and patches for affected products including Red Hat Ansible Automation Platform 2.5 that bundle the vulnerable Pillow versions.

Successful exploitation of this vulnerability may lead to memory corruption, which can cause application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service. The CVSS 4.0 score of 8.6 indicates high impact with local attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

A fixed version of Pillow, 12.1.1, is available and should be applied to remediate this vulnerability. Red Hat has published multiple security advisories and errata providing updated packages that include the fix. Users of affected Red Hat products should apply these updates promptly. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed in Pillow 12.1.1 and corresponding Red Hat package updates.