CVE-2026-42309Medium· 5.5▾ SunlitPillow has a heap buffer overflow with nested list coordinates
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.1%
0.1% → 0.2%
5.5 → 5.1
Last analysed / modified upstream
5.1 → 5.5
Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
pillow >= 11.2.1, < 12.2.0Upgrade to a patched release:
pillow 12.2.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40192High· 7.5Pillow is a Python imaging library
CVE-2026-96640High· 8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96644High· 8.1Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96643High· 6.5Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-96778High· 7.7Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-112893High· 8.2Pillow: Invalid free in FreeType glyph rendering when a stroker is active