CVE-2026-42309: Pillow has a heap buffer overflow with nested list coordinates
(updated )
Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
References
- github.com/advisories/GHSA-5xmw-vc9v-4wf2
- github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82
- github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2251.yaml
- github.com/python-pillow/Pillow/commit/cf6de8ca9b23e714aa5310e1c791eda66fc0b670
- github.com/python-pillow/Pillow/releases/tag/12.2.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2
- nvd.nist.gov/vuln/detail/CVE-2026-42309
Code Behaviors & Features
Detect and mitigate CVE-2026-42309 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →