CVE-2026-42308: Pillow Integer Overflow Vulnerability in Font Processing
Summary
CVE-2026-42308: Pillow has an integer overflow when processing fonts. Affects pillow versions < 12.2.0. Fixed in 12.2.0. How to fix ↓
Also tracked for
- pillow · Bitnami
The same CVE-2026-42308 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. The library is known for its ease of use and extensive functionality, making it a popular choice among developers for image-related tasks. However, it is susceptible to vulnerabilities, including integer overflow issues when processing fonts, which can lead to unexpected behavior or crashes.
Vulnerability Detail
The vulnerability arises from an integer overflow that occurs when Pillow processes fonts. Specifically, if a font advances for each glyph by an excessively large amount, it can cause Pillow to mismanage the current position, leading to an integer overflow. This can result in potential crashes or unexpected behavior in applications using the library, posing a risk to software stability and security.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.2.0
This is the first release that contains the fix.
pip install --upgrade "pillow==12.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the latest version of Pillow as soon as possible.
Conclusion
In summary, CVE-2026-42308 is a moderate severity vulnerability in the Pillow library related to integer overflow during font processing. It is crucial for developers using Pillow to update to version 12.2.0 or later to ensure their applications remain secure and stable.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-42308 is a vulnerability in the Pillow library that involves an integer overflow when processing fonts, potentially leading to application crashes.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's dependencies.
While there are no specific workarounds, it is recommended to prioritize updating Pillow to the latest version to mitigate the risk associated with this vulnerability.
The integer overflow can lead to application crashes or unexpected behavior, which may compromise the stability and security of software that relies on the Pillow library.
The CVSS score for this vulnerability is 5.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
