PT-2026-37198 · Pypi · Pillow

Aclark4Life · Published 2026-05-04 · Updated 2026-05-12 · CVE-2026-42309

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pillow versions 11.2.1 through 12.1.x

Description Passing nested lists as coordinates to APIs that accept coordinates, such as 'ImagePath.Path', 'ImageDraw.ImageDraw.polygon', and 'ImageDraw.ImageDraw.line', can cause a heap buffer overflow. This occurs because nested lists are recursively unpacked beyond the allocated buffer. A heap buffer overflow is a memory corruption issue where data is written past the end of a buffer allocated on the heap, potentially leading to crashes or arbitrary code execution.

Recommendations Update to version 12.2.0.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BIT-PILLOW-2026-42309

CVE-2026-42309

ECHO-7EB6-969E-18B8

GHSA-5XMW-VC9V-4WF2

Affected Products

Pillow

References · 16

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pillow-2026-42309 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42309 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42309 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42309 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42309 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42309 · Vendor Advisory
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 · Note
• https://github.com/python-pillow/Pillow · Note
• https://t.me/CVEtracker/53214 · Telegram Post
• https://twitter.com/CVEnew/status/2053131383963578824 · Twitter Post
• https://twitter.com/CVEarity/status/2053813520328982863 · Twitter Post
• https://t.me/cveNotify/162855 · Telegram Post