Security Advisory

CVE-2026-42309

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-09 04:08:10

Last updated 2026-05-11 14:48:18

Assigner GitHub_M

CVSS score 5.1

State PUBLISHED

Description

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

← Browse all CVEs View on cve.org ↗