CVE-2026-42308: python-pillow pillow Integer Overflow or Wraparound
CVSS: 5.5v3.1MediumAnalyzed
AliasesGHSA-wjx4-4jcj-g98jBIT-pillow-2026-42308PYSEC-2026-165UBUNTU-CVE-2026-42308DEBIAN-CVE-2026-42308CGA-7whc-6c4p-58xvCGA-9fxw-jx5x-55h9CGA-gq5w-f93m-2fhwCGA-jxrr-prpg-68v7CGA-rp73-26r7-mggcCGA-xvh8-5m62-8vh5
Published 09-05-2026Last modified 11-05-2026
Vulnerability summary
CVE-2026-42308 is a medium (CVSS 5.5) Integer Overflow or Wraparound vulnerability in python-pillow pillow. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.5% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.16%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST5.1MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.05 pp
From 0.11% on 19-09-2026
19-09-202619-10-2026
EPSS score0.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- kubeflow-pipelines-visualization-server< 2.16.1-r0
- mlflow< 3.16.0-r0
- open-webui< 0.11.0-r0
- superset-6.0< 6.0.0-r10
Wolfi4 products
- kubeflow-pipelines-visualization-server< 2.16.1-r0
- mlflow< 3.16.0-r0
- open-webui< 0.11.0-r0
- superset-6.0< 6.0.0-r10
Ubuntu2 products
- pillowAll versions (No fix recorded) | < 9.0.1-1ubuntu0.4 | < 10.2.0-1ubuntu1.2 | < 11.3.0-1ubuntu1.3 | < 12.1.1-2ubuntu1.2
- pillow-python2All versions (No fix recorded)
Debian1 product
- pillowAll versions (No fix recorded) | < 11.1.0-5+deb13u3 | < 12.2.0-1
PyPI1 product
- pillow< 12.2.0
Python1 product
- pillow< 12.2.0
Python-pillow1 product
- pillow< 12.2.0
7 vendors · 14 products
References
11 links- github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98jX Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/python-pillow/Pillow/releases/tag/12.2.0X Refsource MISCWEBAdvisoryREPORTProductRelease Notes
