Vulnerability · Published May 9, 2026 · Assigned by GitHub_M
CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinates
Medium 5.1
In plain English
A medium-severity heap buffer overflow in Pillow from python-pillow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | pillow | 12.2.0-1 | DEBIAN-CVE-2026-42309 |
| PyPI | pillow | 12.2.0 | GHSA-5xmw-vc9v-4wf2 |
| PyPI | pillow | 12.2.0 | PYSEC-2026-2251 |
| Ubuntu:22.04:LTS | pillow | 9.0.1-1ubuntu0.4 | USN-8399-1 |
| Ubuntu:24.04:LTS | pillow | 10.2.0-1ubuntu1.2 | USN-8399-1 |
| Ubuntu:25.10 | pillow | 11.3.0-1ubuntu1.3 | USN-8399-1 |
| Ubuntu:25.10 | pillow | 11.3.0-1ubuntu1.3 | UBUNTU-CVE-2026-42309 |
| Ubuntu:26.04:LTS | pillow | 12.1.1-2ubuntu1.2 | USN-8399-1 |
| Ubuntu:26.04:LTS | pillow | 12.1.1-2ubuntu1.2 | UBUNTU-CVE-2026-42309 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 11.2.1, < 12.2.0 |
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC