---
schema_version: '1.0'
id: security-20260711-a57b4f
url: https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2
url_hash: a57b4f807bd47fd0b60083d9c83c1ddde494db5c663e742d902fdd3fd35097ef
canonical_url: https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42309
- GHSA-5xmw-vc9v-4wf2
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-05-04T20:18:27Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:11Z'
status: published
content_hash: df1af190b73d3752fee611de67aba147b0fda67213632ea8d3d97d2f2434317c
license_note: full
summary: Pillow has a heap buffer overflow with nested list coordinates
summary_source: rss
summary_en: Pillow has a heap buffer overflow with nested list coordinates
entities:
- name: HashTag
  type: concept
key_facts: []
related: []
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
title: 'CVE-2026-42309: Pillow has a heap buffer overflow with nested list coordinates'
---

# CVE-2026-42309: Pillow has a heap buffer overflow with nested list coordinates

## TL;DR
Pillow has a heap buffer overflow with nested list coordinates

## Key Points
- cve / CVE-2026-42309 / GHSA-5xmw-vc9v-4wf2 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
**Advisory:** GHSA-5xmw-vc9v-4wf2 (CVE-2026-42309)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
Passing nested lists as coordinates to APIs that accept coordinates such as `ImagePath.Path`, `ImageDraw.ImageDraw.polygon` and `ImageDraw.ImageDraw.line` could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.

**References:**
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2
- https://nvd.nist.gov/vuln/detail/CVE-2026-42309
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2_

## Source
元記事: [CVE-2026-42309: Pillow has a heap buffer overflow with nested list coordinates](https://osv.dev/vulnerability/GHSA-5xmw-vc9v-4wf2) — published 2026-05-04T20:18:27Z