VulnerabilityAnalyzed
CVE-2026-42308
Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow.
MEDIUM 5.1EPSS 0.11%
Does this matter?
Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own.
Description
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- CVSS 4.0
- 5.1 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.11% probability · 2th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- python/pillow
- Source
- security-advisories@github.com
References
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0Product, Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98jVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.