CVE-2026-42311

Affected versions of the pillow package are vulnerable to Out-of-bounds Write due to an integer overflow in PSD tile extent bounds checks that allow attacker-controlled tile dimensions to bypass validation in PSD image decoding and encoding. The bounds checks added in Pillow 12.1.1 to address CVE-2026-25990 use narrow integer types prone to wraparound, so a PSD image with carefully chosen tile dimensions can produce values that wrap around and pass validation while still exceeding the underlying buffer in src/decode.c and src/encode.c. A remote attacker who supplies a malicious PSD file can trigger memory corruption, potentially resulting in a crash or arbitrary code execution.