CVE-2026-42311
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corru
CVSS
7.8
Alto
EPSS
0.1%
p5
KEV
—
Exploit Today
1
0-100
Publicado: 9 may 2026 · Última mod.: 24 jul 2026 · CWE-190 · CWE-787
0.1%EPSS · 30 días0.1%
2026-07-022026-07-30
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
- github.comhttps://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea
- github.comhttps://github.com/python-pillow/Pillow/pull/9520
- github.comhttps://github.com/python-pillow/Pillow/releases/tag/12.2.0
- github.comhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-654238.8 ALT—
——0An integer overflow in the UA_Variant arrayDimensions product
computation in open62541 may allow a remote attacker to trigger an
out-of-bounds write.13hCVE-2026-635597.5 ALT—
——0An integer overflow in the UA_Variant arrayDimensions product
computation in open62541 may allow a remote attacker to read
out-of-bounds heap memory, potentially disclosing sensitive information.14hCVE-2026-54715——
——0GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.15hCVE-2026-11771——
——0OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server17hCVE-2026-478769.3 CRÍ—
——0VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.22hCVE-2026-17544——
——0Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.8h