PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42309 python-pillow CVE debrief

CVE-2026-42309 is a medium-severity heap buffer overflow in Pillow's coordinate handling. Nested lists passed to APIs that accept coordinates could be recursively unpacked beyond the allocated buffer. The issue affects Pillow from 11.2.1 up to, but not including, 12.2.0, and is fixed by validating coordinate lists to contain exactly two numeric values.

Vendor
python-pillow
Product
Pillow
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Teams that ship Python software using Pillow to draw paths, polygons, or lines, especially where coordinate inputs may come from untrusted or loosely validated sources. Package maintainers and platform teams should prioritize any service that accepts user-controlled drawing data.

Technical summary

The flaw is a heap buffer overflow (CWE-122) in Pillow's handling of nested coordinate lists. APIs including ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line could recursively unpack nested lists past the allocated buffer. The patched behavior in 12.2.0 rejects coordinate lists unless they contain exactly two numeric coordinates.

Defensive priority

Medium. NVD assigned CVSS 5.1, and the bug can corrupt heap memory in code paths that process coordinate input. Upgrade urgency is higher for applications that expose image rendering to user-supplied data.

Recommended defensive actions

  • Upgrade Pillow to 12.2.0 or later.
  • Review code paths using ImagePath.Path, polygon, or line with externally influenced coordinates.
  • Add input validation and tests to ensure coordinates are flat pairs of numbers and reject nested lists.
  • If upgrade is delayed, restrict or sanitize all user-controlled drawing inputs and monitor for crashes in rendering workflows.

Evidence notes

Based on the official CVE description and NVD record for CVE-2026-42309, plus the linked GitHub release and security advisory. The published CVE date used here is 2026-05-09T06:16:10.073Z. The source corpus states the affected range as Pillow 11.2.1 through before 12.2.0 and the fix as 12.2.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42309 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42309

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42309 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42309

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.