Live › vulnerability › CVE-2026-42309
Go to dashboardPillow, the Python imaging library, has a heap buffer overflow when nested lists are passed as coordinates to ImagePath.Path, ImageDraw polygon, or ImageDraw line. An attacker who can supply coordinate data to these calls can corrupt heap memory, which may crash the process or lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| pillow | pypi | >= 11.2.1, < 12.2.0 | 12.2.0 |
| python pillow | vendor | >= 11.2.1, < 12.2.0 | 12.2.0 |
pip show pillow and check whether the version is between 11.2.1 and 12.2.0 (exclusive of 12.2.0)Upgrade pillow to 12.2.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-42309")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.