CVE-2026-42309

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursive...

2dify (1.0.1), 3deecelltracker (1.0.1) +2738 more potentially affected by CVE-2026-42309 via pillow (>=11.2.1, <=12.1.1)

pillow PYPI version =11.2.1, =1.0.1, =1.0.0, =0.2.0a0, =0.1.32, =0.0.29, =2.6.7, =0.1.3, =0.1.0, =0.11.1 and more Source cves: CVE-2026-42309 Source advisory: MEND:CVE-2026-42309...

CVE-2026-42309 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, open-webui, mlflow, superset...

2dify (1.0.1), 3deecelltracker (1.0.1) +2738 more potentially affected by CVE-2026-42309 via pillow (>=11.2.1, <=12.1.1)

pillow PYPI version =11.2.1, =1.0.1, =1.0.0, =0.2.0a0, =0.1.32, =0.0.29, =2.6.7, =0.1.3, =0.1.0, =0.11.1 and more Source cves: CVE-2026-42309 Source advisory: SNYK:PYTHON-PILLOW-16419315...

2dify (1.0.1), 3deecelltracker (1.0.1) +2738 more potentially affected by CVE-2026-42309 via pillow (>=11.2.1, <=12.1.1)

pillow PYPI version =11.2.1, =1.0.1, =1.0.0, =0.2.0a0, =0.1.32, =0.0.29, =2.6.7, =0.1.3, =0.1.0, =0.11.1 and more Source cves: CVE-2026-42309 Source advisory: GHSA-5XMW-VC9V-4WF2...