CVE-2026-42309
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Pillow (Python imaging library) from version 11.2.1 to before version 12.2.0 contains a heap buffer overflow vulnerability when passing nested lists as coordinates to APIs such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line. Nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates.
Risk Assessment
An attacker can cause application crashes or potentially execute arbitrary code by supplying specially crafted input to drawing functions.
Recommendation
Update Pillow to version 12.2.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.