Pillow has a heap buffer overflow with nested list coordinates

MEDIUM 5.5CVE-2026-42309 · BIT-pillow-2026-42309 · GHSA-5xmw-vc9v-4wf2 · Published 09/05/2026 · updated 24/07/2026

Package	Affected versions	Patched versions
pillow PyPI	`≥ 11.2.1, < 12.2.0`	`12.2.0`
pillow python	`≥ 11.2.1, < 12.2.0`	`12.2.0`

Description

Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.

NVD description

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

References

python-pillow/Pillow security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-42309 · ADVISORY
designcomputer/mysql_mcp_server commit a96549f · WEB
python-pillow/Pillow commit cf6de8c · WEB
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
python-pillow/Pillow release 12.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pillow

PyPI

≥ 11.2.1, < 12.2.0

12.2.0

pillow

python

≥ 11.2.1, < 12.2.0

12.2.0

Description

NVD description