CVE-2026-42309

Affected versions of the pillow package are vulnerable to a heap-based buffer overflow due to insufficient validation of coordinate input passed to drawing APIs. Passing nested lists as coordinates to ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line causes nested lists to be recursively unpacked beyond the allocated buffer, since coordinate lists were not validated to contain exactly two numeric values. An attacker who can control the coordinate input supplied to these APIs can trigger an out-of-bounds heap write, resulting in memory corruption and potentially impacting the availability of the affected process.