Add CVSS 3.1 score for GHSA-cfh3-3jmp-rvhc (Pillow OOB Write via PSD)

[sunnypatell]

Changes

Added missing CVSS 3.1 scoring to GHSA-cfh3-3jmp-rvhc (Pillow Out-of-Bounds Write via PSD Images).

Added:

• CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High)

Reason for change

This advisory had no CVSS 3.1 score. NVD only provides CVSS 4.0 scoring (8.9) for CVE-2026-25990. Adding a CVSS 3.1 vector ensures broader compatibility with vulnerability management tools that rely on CVSS 3.1 for severity assessment.

CVSS justification

• AV:N because crafted PSD files can be delivered over the network (web uploads, image processing APIs, email attachments)
• AC:L because the OOB write triggers reliably when Pillow processes any crafted PSD file, with no special conditions needed
• PR:N because no authentication is required to submit a crafted image to a processing service
• UI:R because a user or application must actively open/process the crafted PSD file (this differs from the CVSS 4.0 vector which uses UI:N, but file parsing vulnerabilities in CVSS 3.1 conventionally require user interaction since the victim must choose to process the file)
• C:H/I:H/A:H because an out-of-bounds write in Pillow's native C image decoder gives full memory corruption potential: arbitrary code execution, data exfiltration, and process crash

The CVSS 4.0 vector uses UI:N and E:P (PoC exists), resulting in 8.9. The CVSS 3.1 translation uses UI:R per standard practice for file-parsing vulnerabilities, resulting in 8.8.

Supporting links

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-25990
• Fix commits: python-pillow/Pillow@54ba4db, python-pillow/Pillow@9000313
• Pillow changelog: https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html

[Copilot]

Pull request overview

Adds a missing CVSS 3.1 vector to the GHSA advisory so consumers that rely on CVSS v3 can compute severity consistently alongside existing CVSS v4 data.

Changes:

• Add a CVSS_V3 entry with a CVSS:3.1 vector to the advisory’s severity list
• Normalize/fix the JSON file ending/formatting

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The JSON will be invalid if there isn’t a comma separating the CVSS_V3 object from the following CVSS_V4 object. Ensure line 15 ends with a comma (i.e., },) before the next object begins.