GitHub Advisoryadvisory · PyPI
GHSA-wjx4-4jcj-g98j Pillow has an integer overflow when processing fonts
MEDIUM
Official page ↗
- Aliases
- CVE-2026-42308
- Ecosystem
- PyPI
- Packages
- pillow
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-190
- Reviewed
- 2026-05-04
Affected packages
• PyPI pillow: < 12.2.0 → fixed in 12.2.0
Description
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
Related
Alias · CVE (1)
- CVE-2026-42308 Pillow is a Python imaging library. vulnerability
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j web
- https://nvd.nist.gov/vuln/detail/CVE-2026-42308 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml web
- https://github.com/python-pillow/Pillow package
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0 web