CVE search · CVE-2026-42308
CVE-2026-42308
medium 5.1
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- security-advisories@github.com
- Weakness
- CWE-190
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 4.0 | medium 5.1 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
security-advisories@github.comSecondary |
| CVSS 3.1 | medium 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · pillow
References
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0ProductRelease Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98jVendor Advisory