PkgSeer

Vulnerability GHSA-5xmw-vc9v-4wf2

Medium Risk

5 months ago

Pillow has a heap buffer overflow with nested list coordinates

11.2.1 - 12.1.1

Summary

Pillow has a heap buffer overflow with nested list coordinates

Details

Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

5.1.0 - 12.2.0 PYSEC-2026-3495

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

8.2.0 - 12.2.0 PYSEC-2026-3496

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

1.0 - 3.1.0.rc1 and 3.1.0rc1 - 12.2.0 PYSEC-2026-3493

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

5.2.0 - 12.2.0 PYSEC-2026-3494

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

1.0 - 3.1.0.rc1 and 3.1.0rc1 - 12.2.0 GHSA-9hw9-ch79-4vh6

View all vulnerabilities for these packages

Impacted packages

pillow

Timeline

Published

5 months ago

Fixed (12.2.0)

6 months ago

Last Modified

1 hour ago