PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42308 python-pillow CVE debrief

CVE-2026-42308 is a Medium-severity issue in Pillow, the Python imaging library, where excessively large glyph advance values can cause an integer overflow while Pillow tracks the current position. The issue is patched in Pillow 12.2.0. The available source record ties the weakness to CWE-190 and points to the 12.2.0 release and associated GitHub security advisory.

Vendor
python-pillow
Product
Pillow
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Teams that use Pillow for font rendering or image-generation workflows should review this issue, especially if the application processes fonts or text from less-trusted sources. Security and platform owners responsible for Python dependency management should also confirm whether any deployed environments still run Pillow versions prior to 12.2.0.

Technical summary

According to the NVD record and GitHub advisory references, Pillow versions before 12.2.0 could encounter an integer overflow when a font advances for each glyph by an excessively large amount and Pillow updates its current position accordingly. The issue is classified as CWE-190. The fix shipped in Pillow 12.2.0, as referenced by the upstream release and security advisory.

Defensive priority

Moderate. This is a confirmed vulnerability with an available fix, but the supplied CVSS score is 5.1 (Medium) and the NVD vector indicates local attack conditions. Prioritize remediation where Pillow is exposed in text/font rendering paths or where dependency updates are routine and low-risk.

Recommended defensive actions

  • Upgrade Pillow to version 12.2.0 or later in all affected environments.
  • Inventory applications that use Pillow for font or text rendering and verify the installed version.
  • Review dependency manifests, lockfiles, and build artifacts to ensure the patched release is actually deployed.
  • If immediate upgrade is not possible, reduce exposure by limiting processing of untrusted or unexpected font inputs until remediation is complete.
  • Recheck downstream packages or containers that may bundle an older Pillow release even if application code has already been updated.

Evidence notes

The NVD record published on 2026-05-09 identifies the issue, lists CWE-190, and references the upstream Pillow 12.2.0 release and GitHub security advisory. The supplied description states that the problem affects Pillow prior to 12.2.0 and that the issue is patched in 12.2.0. No KEV entry was provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42308 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42308

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42308 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42308

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.