CVE-2026-42308

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

Root has patched CVE-2026-42308 in the pillow package for Root:PyPI. Multiple fixed versions available.

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

TuxCare rebuilt pillow to address 5 CVEs. Fixed in 11.2.1.post3+tuxcare.

TuxCare rebuilt pillow to address 14 CVEs. Fixed in 11.3.0.post5+tuxcare.

TuxCare rebuilt pillow to address 4 CVEs. Fixed in 10.4.0.post10+tuxcare.

TuxCare rebuilt pillow to address 4 CVEs. Fixed in 9.5.0.post8+tuxcare.

TuxCare rebuilt pillow to address 4 CVEs. Fixed in 9.4.0.post9+tuxcare.

TuxCare rebuilt pillow to address 8 CVEs. Fixed in 8.4.0.post8+tuxcare.

Integer overflow when processing fonts. (CVE-2026-42308) PDF Parsing Trailer Infinite Loop (DoS). (CVE-2026-42310)

This update for python-Pillow fixes the following issues

• CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
• CVE-2026-42309: heap buffer overflow when processing nested list coordinates (bsc#1265153).
• CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).

This update for python-Pillow fixes the following issue

• CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).

This update for python-Pillow fixes the following issues

• CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
• CVE-2026-42309: heap buffer overflow when processing nested list coordinates (bsc#1265153).
• CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).

This update for python-Pillow fixes the following issues

• CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
• CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).

It was discovered that Pillow incorrectly handled large glyph advance values in fonts. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2026-42308)

It was discovered that Pillow incorrectly handled nested coordinate lists in certain APIs. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42309)

It was discovered that Pillow incorrectly handled certain malformed PDF files. An attacker could possibly use this issue to cause Pillow to use excessive resources, leading to a denial of service. (CVE-2026-42310)

It was discovered that Pillow incorrectly handled certain malformed PSD files. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42311)

It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112390)

It was discovered that Pillow's PdfParser.get_value() could recurse without a limit while reading nested PDF objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112391)

It was discovered that Pillow's rank-based filters could dereference invalid image storage for a zero-size image. An attacker could possibly use this issue to cause a crash. (CVE-2026-112392)

It was discovered that Pillow had a heap buffer overflow in _tiffWriteProc when saving compressed TIFF data. An attacker could possibly use this issue to crash the process or execute arbitrary code. (CVE-2026-112393)

It was discovered that Pillow's P;2L and P;4L raw decoders could read past the end of an input buffer. An attacker could possibly use this issue to disclose heap memory or crash the process. (CVE-2026-112394)

It was discovered that Pillow's tiled-TIFF decoder could read past the tile buffer while copying four-byte pixels. An attacker could possibly use this issue to expose heap data or crash the process. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112395)

It was discovered that Pillow had a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. An attacker could possibly use this issue to crash the process or execute arbitrary code. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS. (CVE-2026-112396)

It was discovered that Pillow's ImageMorph.MorphOp.apply() could access memory before a row buffer for a zero-width image. An attacker could possibly use this issue to cause a crash. (CVE-2026-112397)

It was discovered that Pillow's FlashPix JPEG-tile decoder could write decoded scanlines beyond the allocated tile buffer. An attacker could possibly use this issue to corrupt heap memory and execute arbitrary code. (CVE-2026-112398)

It was discovered that Pillow could allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112399)

It was discovered that Pillow could retain a rejected GIF frame size after a decompression-bomb exception. An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-112400)

It was discovered that Pillow performed quadratic copying while parsing GIF comments. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-112401)

It was discovered that Pillow could double free image memory when ImagingScaleAffine encounters a selective allocation failure. An attacker could possibly use this issue to crash the process. (CVE-2026-112402)

It was discovered that Pillow's JPEG decoder could write a full-width scanline into a buffer sized for a requested draft scale. An attacker could possibly use this issue to corrupt heap memory or execute arbitrary code. (CVE-2026-112403)

It was discovered that Pillow's TIFF tile and RGBA decode paths could read beyond row data produced by libtiff. An attacker could possibly use this issue to expose heap data or crash the process. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS.…