---
id: "CVE-2026-42309"
kind: "vulnerability"
aliases: ["CVE-2026-42309", "GHSA-5xmw-vc9v-4wf2"]
title: "Pillow has a heap buffer overflow with nested list coordinates"
severity: "medium"
cvss: 5.5
epss: 0.001820000004954636
exploited: false
status: "open"
category: "package"
products: [{"name": "pillow", "fixed": ["12.2.0"], "affected": ">= 11.2.1, < 12.2.0", "ecosystem": "pypi"}, {"name": "python pillow", "fixed": ["12.2.0"], "affected": ">= 11.2.1, < 12.2.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-122", "image-processing", "package", "pillow", "python"]
not_affected_if: ["no-user-controlled-coordinates", "version-12.2.0-or-later", "version-below-11.2.1"]
published_at: "2026-05-04T20:18:27+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5xmw-vc9v-4wf2", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42309", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Pillow has a heap buffer overflow with nested list coordinates

Pillow, the Python imaging library, has a heap buffer overflow when nested lists are passed as coordinates to ImagePath.Path, ImageDraw polygon, or ImageDraw line. An attacker who can supply coordinate data to these calls can corrupt heap memory, which may crash the process or lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pillow affected >= 11.2.1, < 12.2.0 fixed 12.2.0
- vendor:python pillow affected >= 11.2.1, < 12.2.0 fixed 12.2.0

## How to check

Run pip show pillow and check whether the version is between 11.2.1 and 12.2.0 (exclusive of 12.2.0).
Search the codebase for ImagePath.Path, polygon( or line( calls that receive coordinates from user input.

## Fix

Upgrade pillow to 12.2.0 or later.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-5xmw-vc9v-4wf2
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42309

## From the sources

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_