CVE-2026-42311: python-pillow pillow Integer Overflow or Wraparound
CVSS: 8.6v4.0HighAnalyzed
AliasesGHSA-pwv6-vv43-88grBIT-pillow-2026-42311PYSEC-2026-2252UBUNTU-CVE-2026-42311DEBIAN-CVE-2026-42311CGA-5pj2-vf4g-h88jCGA-958f-w7fw-mwx8CGA-99qq-55jw-qx7wCGA-qj5w-2jwv-ccvxCGA-v4vw-7fmm-xfmxCGA-xvf3-8xp5-fq52
Published 09-05-2026Last modified 12-05-2026
Vulnerability summary
CVE-2026-42311 is a high (CVSS 8.6) Integer Overflow or Wraparound vulnerability in python-pillow pillow. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v4.0 (CVE.org)EPSS score
0.22%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 12-05-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
CVSS metrics
9 scores · 7 sources · 2 versionsHigh 8.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.6HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.6HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.8Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.07 pp
From 0.15% on 19-09-2026
19-09-202619-10-2026
EPSS score0.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Chainguard4 products
- kubeflow-pipelines-visualization-server< 2.16.1-r0
- mlflow< 3.16.0-r0
- open-webui< 0.11.0-r0
- superset-6.0< 6.0.0-r10
Wolfi4 products
- kubeflow-pipelines-visualization-server< 2.16.1-r0
- mlflow< 3.16.0-r0
- open-webui< 0.11.0-r0
- superset-6.0< 6.0.0-r10
Ubuntu2 products
- pillow< 11.3.0-1ubuntu1.3 | < 12.1.1-2ubuntu1.2
- pillow-python2All versions (No fix recorded)
Debian1 product
- pillow< 11.1.0-5+deb13u3 | < 12.2.0-1
PyPI1 product
- pillow≥ 10.3.0, < 12.2.0
Python1 product
- pillow≥ 10.3.0, < 12.2.0
Python-pillow1 product
- pillow≥ 10.3.0, < 12.2.0
7 vendors · 14 products
References
12 links- github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88grX Refsource CONFIRMWEBFIXREPORTAdvisoryPatchVendor Advisory
- github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35eaX Refsource MISCWEBFIXPatch
- github.com/python-pillow/Pillow/releases/tag/12.2.0X Refsource MISCWEBAdvisoryREPORTProductRelease Notes
