PT-2026-7584

🗓️ 11 Feb 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Out of bounds write vulnerability CVE-2026-25990 found on the pillow library.

Reporter	Title	Published	Views	Family All 94
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses pillow-12.1.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-25990.	30 Mar 202607:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-10.3.0-cp39-cp39-manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-25990.	16 Apr 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	30 Apr 202612:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillowy affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:25	–	ibm
IBM Security Bulletins	Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.	6 May 202615:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-25990	27 May 202615:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Write in Python Pillow [CVE-2026-25990]	14 Apr 202615:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	16 Mar 202613:27	–	ibm
ATTACKERKB	CVE-2026-25990	11 Feb 202620:53	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-1452)	6 Mar 202600:00	–	nessus

Source	Link
github	www.github.com/python-pillow/Pillow/pull/9427
ubuntu	www.ubuntu.com/security/notices/USN-8047-1
twitter	www.twitter.com/Cezar_H_Linux/status/2028795849099133395
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2026-25990
suse	www.suse.com/support/update/announcement/2026/suse-su-202620992-1
twitter	www.twitter.com/pulsepatchio/status/2023774354740269079
cve	www.cve.org/CVERecord
twitter	www.twitter.com/_cvereports/status/2021798944011907558
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-25990
reddit	www.reddit.com/r/AgentZero/comments/1s4ma5t/devs_close_the_security_holes_in_this_app

30 Apr 2026 00:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 210

CVSS 3.17.5

CVSS 48.6

EPSS0.00014

SSVC

out of bounds write vulnerability 2026 25990 pillow library security researcher cyata