Security · Pillow
Nested coordinate lists overrun a heap buffer in Pillow's drawing
Pillow has a heap buffer overflow with nested list coordinates
- Advisory
- CVE-2026-42309
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- >= 11.2.1, < 12.2.0
- Fixed in
- 12.2.0
- Reaches you
- through another call
What triggers it
Passing nested lists as coordinates to ImageDraw or ImagePath.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
In the drawing APIs, which Image.open never runs.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to Pillow 12.2.0.
Specifically. Not a pre-decode matter: the flaw is in a call that opening a file never makes.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2
- https://osv.dev/vulnerability/PYSEC-2026-2251
- The record entry, triaged 2026-11-03, last checked 2026-11-03