Pillow CVE-2026-42309

Pillow is a Python imaging library that provides APIs for drawing operations on images. The vulnerability exists in coordinate handling for drawing primitives (polygon, line) and path operations. When processing coordinate arguments, the code failed to validate that coordinate pairs were properly formed two-element numeric tuples; instead, it recursively unpacked nested list structures without bounds checking. This classic heap buffer overflow (CWE-122: Stack-based Buffer Overflow / Heap-based) occurs because the unpacking logic did not account for the depth of nesting and continued writing beyond the pre-allocated buffer. The affected CPE is pip/pillow, a Python package distributed via PyPI.