CVE-2026-42309 Pillow: Heap buffer overflow with nested list coordinates
Attackers can trigger heap buffer overflows in Pillow by passing nested lists to coordinate APIs, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42309?
CVE-2026-42309 is a medium-severity memory corruption vulnerability in Python Pillow, published on 9 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
Weakness: CWE-122
Which versions are affected by CVE-2026-42309?
4 open source packages ship an affected version, including pillow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pillow Bitnami | From 11.2.1 | 12.2.0 |
pillow PyPI | From 11.2.1 | 12.2.0 |
pillow PyPI | From 11.2.1 | 12.2.0 |
pillow PyPI | From 11.2.1 | 12.2.0 |
Products include Python Pillow.
How do I fix CVE-2026-42309?
Upgrade pillow to 12.2.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42309 being exploited?
There is no known exploitation of CVE-2026-42309 in the wild and no public exploit code.
Other vulnerabilities in Python Pillow
Sources
Also known as BIT-pillow-2026-42309, CLEANSTART-2026-SE11924, CLEANSTART-2026-YG79254, CLSA-2026-1791446319, DEBIAN-CVE-2026-42309, ECHO-7eb6-969e-18b8 and 8 more.