Catalogo CVE

CVE-2026-42309

Pillow is a Python imaging library. From version…

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

Gravità: High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Published: May 4, 2026, 8:18:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.13% · Oct 29, 2026

Projects and upstream resources

[pillow][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	pillow	`12.2.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-42309]
Debiansid	pillow	`13.0.0-1`	Fixed	[CVE-2026-42309]
Debianforky	pillow	`12.2.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-42309]
Debianforky	pillow	`12.3.0-1`	Fixed	[CVE-2026-42309]
PipRelease not reported	pillow	`12.2.0`	Fixed	[GHSA-5XMW-VC9V-4WF2]Oct 19, 2026, 7:52:26 PM UTC

Showing 5 fix observations. All 28 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	pillow	`10.2.0-1ubuntu1.2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	pillow	`12.2.0`	UnknownSource applicability is not established	Provider not reported
PipRelease not reported	pillow	`12.2.0`	Fixed	[GHSA-5XMW-VC9V-4WF2]Oct 19, 2026, 7:52:26 PM UTC
UnknownRelease not reported	python-pil-doc	`10.2.0-1ubuntu1.2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	python3-pil	`10.2.0-1ubuntu1.2`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	python3-pil.imagetk	`10.2.0-1ubuntu1.2`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	pillow	Not reported	Not affectedDistribution reports not affected	[CVE-2026-42309]
Debianbookworm	pillow	`9.4.0-1.1+deb12u1`	Not affected	[CVE-2026-42309]
Debianbookworm-security	pillow	`9.4.0-1.1+deb12u1`	Not affected	[CVE-2026-42309]
Debianforky	pillow	`12.2.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-42309]
Debianforky	pillow	`12.3.0-1`	Fixed	[CVE-2026-42309]
Debiansid	pillow	`12.2.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-42309]
Debiansid	pillow	`13.0.0-1`	Fixed	[CVE-2026-42309]
Debiantrixie	pillow	Not reported	Not affectedDistribution reports not affected	[CVE-2026-42309]
Debiantrixie	pillow	`11.1.0-5+deb13u4`	Not affected	[CVE-2026-42309]
Debiantrixie-security	pillow	`11.1.0-5+deb13u3`	Not affected	[CVE-2026-42309]
Ubuntu25.10	pillow	`11.1.0-5build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu25.10	pillow	`11.3.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu25.10	pillow	`11.3.0-1ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu25.10	pillow	`11.3.0-1ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu25.10	pillow	`11.3.0-1ubuntu1.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`11.3.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`11.3.0-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`12.0.0-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`12.1.1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC
Ubuntu26.04	pillow	`12.1.1-2ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-42309]Jun 8, 2026, 6:55:48 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "pillow",
      "status": "fixed",
      "release": "sid",
      "version": "13.0.0-1"
    },
    {
      "name": "pillow",
      "status": "fixed",
      "release": "forky",
      "version": "12.3.0-1"
    },
    {
      "name": "pillow",
      "status": "not affected",
      "release": "trixie",
      "version": "11.1.0-5+deb13u4"
    },
    {
      "name": "pillow",
      "status": "not affected",
      "release": "trixie-security",
      "version": "11.1.0-5+deb13u3"
    },
    {
      "name": "pillow",
      "status": "not affected",
      "release": "bookworm",
      "version": "9.4.0-1.1+deb12u1"
    },
    {
      "name": "pillow",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "9.4.0-1.1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "12.2.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "12.2.0-1"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "pillow",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "pillow",
      "fixed_version": "10.2.0-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "python-pil-doc",
      "fixed_version": "10.2.0-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "python3-pil",
      "fixed_version": "10.2.0-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "python3-pil.imagetk",
      "fixed_version": "10.2.0-1ubuntu1.2",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "fixed_version": "12.2.0",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "ecosystem": "pip",
      "provider_url": "https://github.com/advisories/GHSA-5xmw-vc9v-4wf2",
      "fixed_version": "12.2.0",
      "provider_source": "github",
      "provider_record_id": "GHSA-5XMW-VC9V-4WF2",
      "provider_updated_at": "2026-10-19T19:52:26Z"
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.3.0-1ubuntu1.3"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "11.1.0-5build1",
        "11.3.0-1ubuntu1",
        "11.3.0-1ubuntu1.1",
        "11.3.0-1ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-42309",
      "fixed_version": "11.3.0-1ubuntu1.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-42309",
      "provider_updated_at": "2026-06-08T18:55:48.894420208Z",
      "applicability_unknown": true
    },
    {
      "name": "pillow",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.1.1-2ubuntu1.2"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "11.3.0-1ubuntu1",
        "11.3.0-1ubuntu2",
        "12.0.0-1ubuntu1",
        "12.1.1-1ubuntu1",
        "12.1.1-2ubuntu1",
        "12.1.1-2ubuntu1.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-42309",
      "fixed_version": "12.1.1-2ubuntu1.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-42309",
      "provider_updated_at": "2026-06-08T18:55:48.894420208Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-pil]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 9.4.0-1.1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
[python3-pil.imagetk]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 9.4.0-1.1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
[python-pil-doc]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 9.4.0-1.1+deb12u1 · all · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · all · bookworm
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · all · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 9.4.0-1.1+deb12u1 · all · bookworm-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14

[Debian 13 (Trixie)]

[python3-pil]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 11.1.0-5+deb13u4 · amd64 · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u4 · arm64 · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · amd64 · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · arm64 · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
[python3-pil.imagetk]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 11.1.0-5+deb13u4 · amd64 · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u4 · arm64 · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · amd64 · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · arm64 · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
[python-pil-doc]Sconosciuto
Pacchetto sorgente: [pillow]
Dettagli (4)
- 11.1.0-5+deb13u4 · all · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u4 · all · trixie
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · all · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14
- 11.1.0-5+deb13u3 · all · trixie-security
  Sconosciuto · Corretta: 12.2.0-1
  Version impact unknown
  nvd · pillow · debian · bookworm; pypi · pillow · debian · 14

Osservato: Oct 29, 2026, 10:47:42 AM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]