CVE-2026-42309Medium· 5.5▾ SunlitPillow has a heap buffer overflow with nested list coordinates
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.1%
Last analysed / modified upstream
Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.
pillow >= 11.2.1, < 12.2.0Upgrade to a patched release:
pillow 12.2.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42310Medium· 5.5Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
CVE-2023-50447High· 8.1Arbitrary Code Execution in Pillow
CVE-2026-59198Medium· 6.5Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
CVE-2026-59203Medium· 5.3Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
CVE-2026-55798Medium· 4.5Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
CVE-2026-54059High· 7.5Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF f…