---
schema_version: '1.0'
id: security-20260714-388e4d
url: https://osv.dev/vulnerability/PYSEC-2026-2251
url_hash: 388e4df184138d88c33f0b1320d8a602d7e725b25d458a424720b8f8076f086c
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2251
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42309
- PYSEC-2026-2251
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-05-09T06:16:10Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:43:41Z'
status: published
content_hash: 07473f394620fb85328e8fc4eeeb361a289fe68b5938e94a3ca8e5b754d75d46
license_note: full
summary: Pillow is a Python imaging library. From version 11.2.1 to before version
  12.2.0, passing nested lists as coordinates to APIs that accept coordinates such
  as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could
  cause a heap buffer overflow, as nested lis
summary_source: rss
summary_en: Pillow is a Python imaging library. From version 11.2.1 to before version
  12.2.0, passing nested lists as coordinates to APIs that accept coordinates such
  as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could
  cause a heap buffer overflow, as nested lis
entities:
- name: Pillow
  type: artifact
key_facts: []
related: []
related_auto: []
title: CVE-2026-42309 — pillow
---

# CVE-2026-42309 — pillow

## TL;DR
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lis

## Key Points
- cve / CVE-2026-42309 / PYSEC-2026-2251 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2251 (CVE-2026-42309)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

**References:**
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2251_

## Source
元記事: [CVE-2026-42309 — pillow](https://osv.dev/vulnerability/PYSEC-2026-2251) — published 2026-05-09T06:16:10Z