Pillow has an integer overflow when processing fonts

GHSA-wjx4-4jcj-g98j · BIT-pillow-2026-42308 · CVE-2026-42308 · PYSEC-2026-165

Published May 4, 2026 · Modified Jun 8, 2026

Description

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.

References

WEB https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42308
WEB https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml
PACKAGE https://github.com/python-pillow/Pillow
WEB https://github.com/python-pillow/Pillow/releases/tag/12.2.0

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes