BIT-pillow-2026-42308

vendorUSosv

Pillow: Integer overflow when processing fonts

view advisory published 2026-05-12Licence: per source

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-42308US	medium5.5	0.11% (1st)	—	2026-05-09
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may…

references

External citations — patches, advisories, analysis.

https://github.com/python-pillow/Pillow/releases/tag/12.2.0ARTICLE
https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98jADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-42308WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan