Vulnerability Description
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Pillow | < 12.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0ProductRelease Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98jVendor Advisory
FAQ
What is CVE-2026-42308?
CVE-2026-42308 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer ...
How severe is CVE-2026-42308?
CVE-2026-42308 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42308?
Check the references section above for vendor advisories and patch information. Affected products include: Python Pillow.