# GHSA-cfh3-3jmp-rvhc

## Summary

Pillow 10.3.0–12.1.0 allows an out-of-bounds write when loading specially crafted PSD images, potentially leading to memory corruption.

## Description

## Summary
An out-of-bounds write can be triggered in Pillow when loading a specially crafted PSD image. This affects Pillow versions >=10.3.0 and <12.1.1.

## Details
The GitHub advisory reports that parsing a crafted PSD file can cause an out-of-bounds write in Pillow, which may lead to memory corruption. The issue is fixed in Pillow 12.1.1. A workaround is to disallow PSD parsing by using the `formats` parameter to `Image.open()`.

## Reproduction Steps
> Note: The advisory does not provide a public PoC or sample PSD. The steps below require a crafted PSD that triggers the issue.
1. Set up a vulnerable environment:
   ```bash
   python -m venv venv
   source venv/bin/activate
   pip install pillow==12.1.0
   ```
2. Obtain a specially crafted PSD image that triggers the vulnerability (not provided in the advisory).
3. Run the following script to open the PSD:
   ```python
   from PIL import Image
   Image.open("crafted.psd").load()
   ```

### Expected vs Vulnerable Behavior
- **Expected (patched)**: The PSD is rejected or safely parsed without memory corruption.
- **Vulnerable**: The process may crash, hang, or exhibit memory corruption due to an out-of-bounds write.

## Indicators of Success
- Application crash or abnormal termination while opening the crafted PSD.
- Debugger/ASAN reports indicating out-of-bounds write during PSD parsing.

## Workarounds
- Use `Image.open(..., formats=[...])` to exclude PSD format from being opened.

## References
- https://github.com/advisories/GHSA-CFH3-3JMP-RVHC
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc
- https://github.com/python-pillow/Pillow/pull/9427
- https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199
- https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa
- https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-25990