CVE-2026-42308CWE-190

Pillow: Integer overflow when processing fonts

Medium · published May 9, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00159 · 4.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-05-09T04:09Z
EPSS history
Timeline
  • 09 MAY 04:09Z
    Pillow: Integer overflow when processing fonts
    cvelistv5