CVE-2026-42308: Pillow: Integer overflow when processing fonts
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
Other sources
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 12.2.0 - Upgrade
Upgrade
debian/pillowto a version that resolves this vulnerability.Fixed in 12.2.0-1 - Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 12.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42308?
The severity of CVE-2026-42308 is classified as high due to the potential for an integer overflow that can affect functionality.
How do I fix CVE-2026-42308?
To fix CVE-2026-42308, upgrade Pillow to version 12.2.0 or later using pip.
What is CVE-2026-42308?
CVE-2026-42308 is a vulnerability that arises from handling excessive font advances that can cause an integer overflow in Pillow.
What versions of Pillow are affected by CVE-2026-42308?
Versions of Pillow prior to 12.2.0 are affected by CVE-2026-42308.
Is there a workaround for CVE-2026-42308?
There are no recommended workarounds for CVE-2026-42308; the only resolution is to upgrade to the patched version.