p PatchFirst

CVE-2026-42309

CVE-2026-42309 · Pillow: Heap buffer overflow with nested list coordinates

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

CVSS 5.1 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pillow

    Versions
    • >= 11.2.1, < 12.2.0: Affected

    No fix published

  • pillow Debian:14

    Versions
    • 11.1.0-5
    • 11.2.1-1
    • 11.3.0-1
    • 12.0.0-1
    • 12.1.0-1
    • 12.1.1-1
    • 12.1.1-2
    Affected ranges
    • ECOSYSTEM: < 12.2.0-1

    Update to 12.2.0-1

  • pillow PyPI

    Versions
    • 11.2.1
    • 11.3.0
    • 12.0.0
    • 12.1.0
    • 12.1.1
    Affected ranges
    • ECOSYSTEM: ≥ 11.2.1, < 12.2.0

    Update to 12.2.0

  • pillow Ubuntu:25.10

    Versions
    • 11.1.0-5build1
    • 11.3.0-1ubuntu1
    • 11.3.0-1ubuntu1.1
    • 11.3.0-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 11.3.0-1ubuntu1.3

    Update to 11.3.0-1ubuntu1.3

  • pillow Ubuntu:26.04:LTS

    Versions
    • 11.3.0-1ubuntu1
    • 11.3.0-1ubuntu2
    • 12.0.0-1ubuntu1
    • 12.1.1-1ubuntu1
    • 12.1.1-2ubuntu1
    • 12.1.1-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 12.1.1-2ubuntu1.2

    Update to 12.1.1-2ubuntu1.2

Original sources

Check your server →