What’s Vulnerable › Vulnerabilities

CVE-2026-42309: Pillow: Heap buffer overflow with nested list coordinates

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-09 · updated 2026-07-24
• Weakness: CWE-122

Description

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

Affected products

• python-pillow Pillow: from 11.2.1 before 12.2.0 — fixed in 12.2.0

How to fix

Upgrade to a fixed version: python-pillow Pillow 12.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/python-pillow/Pillow/releases/tag/12.2.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2

Get alerted when CVE-2026-42309 or the next vulnerability affects your stack