CVE-2026-42308: Pillow: Integer overflow when processing fonts
Published May 4, 2026
·Updated
If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.
Affected Software
2 affected componentsFixes available
pip/pillow<12.2.0
12.2.0
Python Pillow<12.2.0
Event History
May 4, 2026
Advisory Published
via GitHub·08:18 PM
Data Sourced
via GitHub·08:18 PM
DescriptionWeaknessAffected Software
May 9, 2026
CVE Published
via MITRE·04:09 AM
Data Sourced
via MITRE·04:09 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-42308?
The severity of CVE-2026-42308 is classified as high due to the potential for an integer overflow that can affect functionality.
2
How do I fix CVE-2026-42308?
To fix CVE-2026-42308, upgrade Pillow to version 12.2.0 or later using pip.
3
What is CVE-2026-42308?
CVE-2026-42308 is a vulnerability that arises from handling excessive font advances that can cause an integer overflow in Pillow.
4
What versions of Pillow are affected by CVE-2026-42308?
Versions of Pillow prior to 12.2.0 are affected by CVE-2026-42308.
5
Is there a workaround for CVE-2026-42308?
There are no recommended workarounds for CVE-2026-42308; the only resolution is to upgrade to the patched version.