PyPI: pillow
CVE-2026-42308
Safety vulnerability ID: SFTY-20260504-37305
Affected versions of the Pillow package are vulnerable to Integer Overflow due to unchecked accumulation of glyph advance values while tracking the current rendering position during font processing. The `font` module fails to properly handle large glyph advance values, causing the running position counter to wrap around because the arithmetic is performed in a fixed-width integer type. A remote attacker who can supply a crafted font file to a target using Pillow's font rendering can trigger the overflow, leading to incorrect memory calculations and potential memory corruption.
Overview
Pillow has an integer overflow when processing fonts
Advisory
pillow – Integer Overflow or Wraparound
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260504-37305/CVE-2026-42308
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42308
- https://data.safetycli.com/changelogs/pillow/
- https://github.com/advisories/GHSA-wjx4-4jcj-g98j
- https://pypi.org/project/pillow
- https://github.com/python-pillow/Pillow/commit/612e3c24a4f38837a6d915fe8eac15a7d1eeca17
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j
- https://nvd.nist.gov/vuln/detail/CVE-2026-42308
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml
- https://github.com/advisories/GHSA-wjx4-4jcj-g98j
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more