Vulnerability Description
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Pillow | >= 11.2.1, < 12.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0ProductRelease Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2Vendor Advisory
FAQ
What is CVE-2026-42309?
CVE-2026-42309 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygo...
How severe is CVE-2026-42309?
CVE-2026-42309 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42309?
Check the references section above for vendor advisories and patch information. Affected products include: Python Pillow.