CVE-2026-42309

A flaw was found in Pillow, a Python imaging library. A malicious actor could exploit this vulnerability by providing specially crafted nested lists as coordinates to image processing APIs within Pillow. This could lead to a heap buffer overflow, potentially causing a denial of service in applications using the library.

This Moderate impact vulnerability in the Pillow Python imaging library could lead to a denial of service. Applications processing untrusted image data that utilize specific Pillow APIs, such as ImagePath.Path, ImageDraw.ImageDraw.polygon, or ImageDraw.ImageDraw.line, with specially crafted nested list coordinates are susceptible to a heap buffer overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.