CVE-2026-42308
Pillow: Integer overflow when processing fonts
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Pillow: Integer overflow when processing fonts
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
CVE-2026-42308- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-28900
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
EUVD-2026-28900- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wjx4-4jcj-g98j
Pillow has an integer overflow when processing fonts
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
- Record
GHSA-wjx4-4jcj-g98j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
CVE-2026-42308- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Pillow: Integer overflow when processing fonts
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
CVE-2026-42308- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42308
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
DEBIAN-CVE-2026-42308- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVGHSA-wjx4-4jcj-g98j
Pillow has an integer overflow when processing fonts
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
- Record
GHSA-wjx4-4jcj-g98j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVOESA-2026-2515
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)
- Record
OESA-2026-2515- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2516
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)
- Record
OESA-2026-2516- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2517
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)
- Record
OESA-2026-2517- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2518
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)
- Record
OESA-2026-2518- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2519
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.(CVE-2026-42310)
- Record
OESA-2026-2519- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVPYSEC-2026-165
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
PYSEC-2026-165- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-42308
CVE-2026-42308 in pillow - Patched by Root
Root has patched CVE-2026-42308 in the pillow package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-42308- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-42308
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
UBUNTU-CVE-2026-42308- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-pillow-2026-42308 No score
Pillow: Integer overflow when processing fonts
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
- Record
BIT-pillow-2026-42308- Updated
- 2026-11-02
OSVCLSA-2026-1786468070 No score
TuxCare security update for pillow (5 CVEs)
TuxCare rebuilt pillow to address 5 CVEs. Fixed in 11.2.1.post3+tuxcare.
- Record
CLSA-2026-1786468070- Updated
- 2026-11-02
OSVCLSA-2026-1790674233 No score
TuxCare security update for pillow (14 CVEs)
TuxCare rebuilt pillow to address 14 CVEs. Fixed in 11.3.0.post5+tuxcare.
- Record
CLSA-2026-1790674233- Updated
- 2026-11-02
OSVCLSA-2026-1790685259 No score
TuxCare security update for pillow (4 CVEs)
TuxCare rebuilt pillow to address 4 CVEs. Fixed in 10.4.0.post10+tuxcare.
- Record
CLSA-2026-1790685259- Updated
- 2026-11-02
OSVCLSA-2026-1790747347 No score
TuxCare security update for pillow (4 CVEs)
TuxCare rebuilt pillow to address 4 CVEs. Fixed in 9.5.0.post8+tuxcare.
- Record
CLSA-2026-1790747347- Updated
- 2026-11-02
OSVCLSA-2026-1790751826 No score
TuxCare security update for pillow (4 CVEs)
TuxCare rebuilt pillow to address 4 CVEs. Fixed in 9.4.0.post9+tuxcare.
- Record
CLSA-2026-1790751826- Updated
- 2026-11-02
OSVCLSA-2026-1790754735 No score
TuxCare security update for pillow (8 CVEs)
TuxCare rebuilt pillow to address 8 CVEs. Fixed in 8.4.0.post8+tuxcare.
- Record
CLSA-2026-1790754735- Updated
- 2026-11-02
OSVMGASA-2026-0219 No score
Updated python-pillow packages fix security vulnerabilities
Integer overflow when processing fonts. (CVE-2026-42308) PDF Parsing Trailer Infinite Loop (DoS). (CVE-2026-42310)
- Record
MGASA-2026-0219- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20831-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues
- CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
- CVE-2026-42309: heap buffer overflow when processing nested list coordinates (bsc#1265153).
- CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).
- Record
openSUSE-SU-2026:20831-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2004-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issue
- CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
- Record
SUSE-SU-2026:2004-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21861-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues
- CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
- CVE-2026-42309: heap buffer overflow when processing nested list coordinates (bsc#1265153).
- CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).
- Record
SUSE-SU-2026:21861-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2234-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues
- CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
- CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).
- Record
SUSE-SU-2026:2234-1- Updated
- 2026-11-02
OSVUSN-8399-1 No score
pillow vulnerabilities
It was discovered that Pillow incorrectly handled large glyph advance values in fonts. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2026-42308)
It was discovered that Pillow incorrectly handled nested coordinate lists in certain APIs. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42309)
It was discovered that Pillow incorrectly handled certain malformed PDF files. An attacker could possibly use this issue to cause Pillow to use excessive resources, leading to a denial of service. (CVE-2026-42310)
It was discovered that Pillow incorrectly handled certain malformed PSD files. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42311)
- Record
USN-8399-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
before 12.2.0 | 12.2.0 |
pillowBitnami |
before 12.2.0 | 12.2.0 |
pillowTuxCare:PyPI |
11.2.1 up to 11.2.1.post3+tuxcare, plus listed versions 11.2.1.post1+tuxcare11.2.1.post2+tuxcare |
11.2.1.post3+tuxcare |
pillowTuxCare:PyPI |
11.3.0 up to 11.3.0.post5+tuxcare, plus listed versions 11.3.0.post1+tuxcare11.3.0.post2+tuxcare11.3.0.post3+tuxcare11.3.0.post4+tuxcare |
11.3.0.post5+tuxcare |
pillowTuxCare:PyPI |
10.4.0 up to 10.4.0.post10+tuxcare, plus listed versions 10.4.0.post1+tuxcare10.4.0.post2+tuxcare10.4.0.post3+tuxcare10.4.0.post4+tuxcare10.4.0.post5+tuxcare Show 4 moreShow less10.4.0.post6+tuxcare10.4.0.post7+tuxcare10.4.0.post8+tuxcare10.4.0.post9+tuxcare |
10.4.0.post10+tuxcare |
pillowTuxCare:PyPI |
9.5.0 up to 9.5.0.post8+tuxcare, plus listed versions 9.5.0.post1+tuxcare9.5.0.post2+tuxcare9.5.0.post3+tuxcare9.5.0.post4+tuxcare9.5.0.post5+tuxcare9.5.0.post6+tuxcare9.5.0.post7+tuxcare |
9.5.0.post8+tuxcare |
pillowTuxCare:PyPI |
9.4.0 up to 9.4.0.post9+tuxcare, plus listed versions 9.4.0.post1+tuxcare9.4.0.post2+tuxcare9.4.0.post3+tuxcare9.4.0.post4+tuxcare9.4.0.post5+tuxcare9.4.0.post6+tuxcare9.4.0.post7+tuxcare9.4.0.post8+tuxcare |
9.4.0.post9+tuxcare |
pillowTuxCare:PyPI |
8.4.0 up to 8.4.0.post8+tuxcare, plus listed versions 8.4.0.post1+tuxcare8.4.0.post2+tuxcare8.4.0.post3+tuxcare8.4.0.post4+tuxcare8.4.0.post5+tuxcare8.4.0.post6+tuxcare8.4.0.post7+tuxcare |
8.4.0.post8+tuxcare |
pillowDebian:12 |
All versions, plus listed versions 10.0.0-110.1.0-110.2.0-110.3.0-110.3.0-2 Show 18 moreShow less10.4.0-110.4.0-1.111.1.0-111.1.0-211.1.0-311.1.0-411.1.0-511.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-212.2.0-112.3.0-19.4.0-1.19.4.0-1.1+deb12u19.5.0-1 |
None known |
pillowDebian:13 |
before 11.1.0-5+deb13u3, plus listed versions 11.1.0-511.1.0-5+deb13u111.1.0-5+deb13u2 |
11.1.0-5+deb13u3 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pillowDebian:14 |
before 12.2.0-1, plus listed versions 11.1.0-511.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-2 |
12.2.0-1 |
pillowPyPI |
before 12.2.0, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.810.0.010.0.110.1.010.2.010.3.010.4.011.0.011.1.011.2.111.3.012.0.012.1.012.1.12.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.0 |
12.2.0 |
python-pillowMageia:9 |
before 9.2.0-3.3.mga9 | 9.2.0-3.3.mga9 |
python-pillowopenEuler:24.03-LTS-SP1 |
before 10.3.0-5.oe2403sp1 | 10.3.0-5.oe2403sp1 |
python-pillowopenEuler:24.03-LTS-SP3 |
before 10.3.0-5.oe2403sp3 | 10.3.0-5.oe2403sp3 |
python-pillowopenEuler:20.03-LTS-SP4 |
before 9.0.1-8.oe2003sp4 | 9.0.1-8.oe2003sp4 |
python-pillowopenEuler:22.03-LTS-SP4 |
before 9.0.1-8.oe2203sp4 | 9.0.1-8.oe2203sp4 |
python-pillowopenEuler:24.03-LTS |
before 10.3.0-5.oe2403 | 10.3.0-5.oe2403 |
pillowRoot:PyPI |
before 12.1.0+aikido.4 | 12.1.0+aikido.410.3.0+aikido.310.3.0+aikido.410.3.0+aikido.510.3.0+aikido.612.1.0+aikido.510.3.0+aikido.712.1.0+aikido.610.3.0+aikido.810.4.0+aikido.89.5.0+aikido.79.3.0+aikido.79.3.0+aikido.811.0.0+aikido.711.1.0+aikido.711.2.1+aikido.212.1.0+aikido.710.3.0+aikido.99.3.0+aikido.910.3.0+aikido.1012.1.0+aikido.811.2.1+aikido.311.1.0+aikido.811.0.0+aikido.812.1.0+aikido.912.1.0+aikido.1010.3.0+aikido.119.3.0+aikido.109.3.0+aikido.1111.1.0+aikido.910.4.0+aikido.911.2.1+aikido.49.5.0+aikido.89.5.0+aikido.912.1.0+aikido.119.5.0+aikido.1011.1.0+aikido.1010.4.0+aikido.1011.0.0+aikido.910.3.0+aikido.1211.2.1+aikido.59.3.0+aikido.129.5.0+aikido.119.3.0+aikido.1310.4.0+aikido.1112.1.0+aikido.1211.2.1+aikido.611.1.0+aikido.1110.3.0+aikido.1311.0.0+aikido.1011.2.1+aikido.79.3.0+aikido.1411.1.0+aikido.129.5.0+aikido.1210.4.0+aikido.129.3.0+aikido.1511.1.0+aikido.1312.1.0+aikido.1310.3.0+aikido.1411.0.0+aikido.119.3.0+aikido.1610.3.0+aikido.1510.4.0+aikido.139.3.0+aikido.179.5.0+aikido.1311.2.1+aikido.811.0.0+aikido.1211.1.0+aikido.1412.1.0+aikido.1410.3.0+aikido.1610.4.0+aikido.1411.1.0+aikido.1511.2.1+aikido.910.4.0+aikido.1512.1.0+aikido.1510.3.0+aikido.1711.0.0+aikido.139.5.0+aikido.1410.4.0+aikido.1610.3.0+aikido.1810.3.0+aikido.1910.4.0+aikido.1710.3.0+aikido.20 |
pillowUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu4 Show 12 moreShow less2.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu22.3.0-1ubuntu32.3.0-1ubuntu3.22.3.0-1ubuntu3.32.3.0-1ubuntu3.42.3.0-1ubuntu3.4+esm12.3.0-1ubuntu3.4+esm22.3.0-1ubuntu3.4+esm32.3.0-1ubuntu3.4+esm42.3.0-1ubuntu3.4+esm5 |
None known |
pillowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.9.0-13.0.0-13.0.0-1build13.1.0-13.1.1-1 Show 9 moreShow less3.1.2-0ubuntu13.1.2-0ubuntu1.13.1.2-0ubuntu1.33.1.2-0ubuntu1.43.1.2-0ubuntu1.53.1.2-0ubuntu1.63.1.2-0ubuntu1.6+esm13.1.2-0ubuntu1.6+esm23.1.2-0ubuntu1.6+esm3 |
None known |
pillowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.1.1-3build24.3.0-2ubuntu15.0.0-15.1.0-15.1.0-1ubuntu0.2 Show 8 moreShow less5.1.0-1ubuntu0.35.1.0-1ubuntu0.45.1.0-1ubuntu0.55.1.0-1ubuntu0.65.1.0-1ubuntu0.75.1.0-1ubuntu0.85.1.0-1ubuntu0.8+esm15.1.0-1ubuntu0.8+esm2 |
None known |
pillowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1 Show 10 moreShow less7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.47.0.0-4ubuntu0.57.0.0-4ubuntu0.67.0.0-4ubuntu0.77.0.0-4ubuntu0.87.0.0-4ubuntu0.97.0.0-4ubuntu0.9+esm1 |
None known |
pillow-python2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 6.2.1-3~build16.2.1-36.2.1-3ubuntu0.1~esm16.2.1-3ubuntu0.1~esm2 |
None known |
pillowUbuntu:22.04:LTS |
before 9.0.1-1ubuntu0.4, plus listed versions 8.1.2+dfsg-0.39.0.0-19.0.1-19.0.1-1build19.0.1-1ubuntu0.19.0.1-1ubuntu0.29.0.1-1ubuntu0.3 |
9.0.1-1ubuntu0.4 |
pillowUbuntu:24.04:LTS |
before 10.2.0-1ubuntu1.2, plus listed versions 10.0.0-110.1.0-110.2.0-110.2.0-1build110.2.0-1ubuntu1 |
10.2.0-1ubuntu1.2 |
pillowUbuntu:25.10 |
before 11.3.0-1ubuntu1.3, plus listed versions 11.1.0-5build111.3.0-1ubuntu111.3.0-1ubuntu1.111.3.0-1ubuntu1.2 |
11.3.0-1ubuntu1.3 |
pillowUbuntu:26.04:LTS |
before 12.1.1-2ubuntu1.2, plus listed versions 11.3.0-1ubuntu111.3.0-1ubuntu212.0.0-1ubuntu112.1.1-1ubuntu112.1.1-2ubuntu112.1.1-2ubuntu1.1 |
12.1.1-2ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42308 is a medium vulnerability (CVSS 5.1) in Python Pillow, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in pillow 12.2.0.
References
github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j
nvd.nist.gov/vuln/detail/CVE-2026-42308
Show 28 moreShow less
security-tracker.debian.org/tracker/CVE-2026-42308
advisories.mageia.org/MGASA-2026-0219.html
bugs.mageia.org/show_bug.cgi?id=35657
ubuntu.com/security/notices/USN-8399-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2515
suse.com/support/update/announcement/2026/suse-su-20262004-1
bugzilla.suse.com/1265359
cve.org/CVERecord?id=CVE-2026-42308
Left out here: 55 versions. The JSON record has them.