An out-of-bounds write vulnerability exists in Pillow when loading specially crafted PSD images. This affects Pillow versions from 10.3.0 up to but not including 12.1.1. The issue can lead to memory corruption. A fix is available in Pillow 12.1.1. Users can mitigate risk by preventing PSD images from being opened using the formats parameter in Image.open().