CVE-2026-42308
MediumAdvisory
Published 4 May 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.001
- 2nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 181
- of 17,781 indexed, latest versions
- Container images
- 184
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Pillow has an integer overflow when processing fonts
Carried by container images the latest versions of 181 of 17,781 indexed charts deploy, on 184 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pillowpypi | 2.6.1, 4.3.0, 5.0.0, 5.1.0+33 more | 12.2.0 | 184 |
| pillowdeb | 5.1.0-1, 5.1.0-1ubuntu0.6, 7.0.0-4ubuntu0.5, 9.0.1-1ubuntu0.3+3 more | 9.0.1-1ubuntu0.4, 10.2.0-1ubuntu1.2 | 10 |
- OSV records
- DEBIAN-CVE-2026-42308GHSA-wjx4-4jcj-g98jUBUNTU-CVE-2026-42308
- Also known as
- BIT-pillow-2026-42308, PYSEC-2026-165, USN-8399-1
Charts affected
181 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| huntingfactlyVerified publisher | 0.4.14 | 1 of 1See more | 4,085 |
| tandoorgabe565Verified publisher | 0.9.9 | 1 of 2See more | 2,183 |
| babybuddygeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,489 |
| beetsgeek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 1,150 |
| delugegeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 13,551 |
| mylargeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 1,423 |
| pyloadgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 1,236 |
| seafilegeek-cookbookVerified publisher | 3.2.0 | 1 of 1See more | 24,293 |
| skypilotgeek-cookbookVerified publisher | 0.0.1 | 1 of 3See more | 8,923 |
| esphomehelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 6,008 |
| home-assistanthelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 4,647 |
| supersethelm-charts-nr | 1.1.3 | 1 of 1See more | 2,305 |
| weblatehelm-charts-nr | 0.3.2 | 1 of 3See more | 7,984 |
| supersethelmforgeVerified publisher | 1.3.6 | 1 of 5See more | 5,714 |
| openbashelm-openbasVerified publisher | 1.8.14 | 1 of 7See more | 25,017 |
| paperlesshomelabcihelmchartstestVerified publisher | 9.1.9 | 1 of 1See more | 16,384 |
| ilum-streamlitilumVerified publisher | 0.1.0 | 1 of 1See more | 2,736 |
| erpnextimprowisedVerified publisher | 3.3.0 | 1 of 3See more | 6,501 |
| frigateimprowisedVerified publisher | 1.1.0 | 1 of 1See more | 2,159 |
| guardrails-usvcinfracloud-chartsVerified publisher | 1.0.1 | 1 of 1See more | 5,062 |
| label-studioinseefrlab | 2.3.1 | 1 of 3See more | 3,157 |
| intelowlintelowl-helm | 6.6.1-01-06-2026 | 1 of 5See more | 17,852 |
| inventreeinventreeOfficialVerified publisher | 0.4.28 | 1 of 2See more | 5,788 |
| twitch-channel-points-minerjacobcolvinVerified publisher | 0.1.0 | 1 of 1See more | 1,088 |
| deconzjanip81-helm-chartsVerified publisher | 0.1.1 | 1 of 1See more | 10,780 |
| beetsk8s-home-lab-repo | 3.1.1 | 1 of 1See more | 2,733 |
| frigatek8s-home-lab-repo | 9.1.1 | 1 of 1See more | 2,370 |
| paperlessk8s-home-lab-repo | 11.0.1 | 1 of 1See more | 9,103 |
| music-assistantkarljorgensen | 0.1.3 | 1 of 1See more | 7,081 |
| home-assistantkfirfer | 0.5.4 | 1 of 1See more | 6,447 |
| aperagkubeblocksVerified publisher | 0.0.0-nightly | 1 of 3See more | 8,405 |
| delugelinkding | 0.2.3 | 1 of 1See more | 1,433 |
| calendar-apiliturgical | 0.1.5 | 1 of 1See more | 1,556 |
| liturgical-apiliturgical | 0.2.11 | 1 of 1See more | 1,004 |
| exposureloglsst-sqre | 0.2.1 | 1 of 1See more | 2,078 |
| hyperglassm0nsterrr-hyperglassVerified publisher | 4.2.1 | 1 of 2See more | 4,647 |
| meerschaummeerschaumVerified publisher | 0.2.0 | 1 of 1See more | 5,823 |
| mlflowmondata-helm-chartsVerified publisher | 0.2.3 | 1 of 1See more | 3,811 |
| face-recognitionmoreillonVerified publisher | 0.2.4 | 1 of 3See more | 8,556 |
| paperless-ngxmt190502 | 7.6.14 | 1 of 4See more | 11,950 |
| szurubooru-servermy0nVerified publisher | 0.2.5 | 1 of 3See more | 1,043 |
| mlflowncsaVerified publisher | 1.2.1 | 1 of 4See more | 5,456 |
| polyglotncsaVerified publisher | 0.1.1 | 1 of 18See more | 55,726 |
| neurofaceneurofaceVerified publisher | 1.4.2 | 1 of 3See more | 7,310 |
| splashntppoolVerified publisher | 1.0.4 | 1 of 1See more | 27,633 |
| chatbot-ai-sampleopenshift | 0.1.6 | 1 of 4See more | 18,922 |
| ctfdpascaliskeVerified publisher | 2.0.0 | 1 of 1See more | 2,376 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 4,749 |
| seafilephybros-helm-charts | 4.0.1 | 1 of 1See more | 22,084 |
| powerdnspuckpuck | 2.0.0 | 1 of 4See more | 4,616 |
Container images carrying it
184 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opencsghq/ | af7191a9cf8a | pillow | 12.2.0 | 1 |
| opencsghq/ | c36a5bac3cf0 | pillow | 12.2.0 | 1 |
| opencsghq/ | 47e22aa71870 | pillow | 12.2.0 | 1 |
| opencsghq/ | b4e849fcf94a | pillow | 12.2.0 | 1 |
| opendatacube/ | 120457ffcd69 | pillow pillow | 10.2.0-1ubuntu1.2 12.2.0 | 1 |
| opendatacube/ | 1b90cdf68831 | pillow pillow | no fix listed 12.2.0 | 1 |
| opendatacube/ | 80df355a660b | pillow pillow | 9.0.1-1ubuntu0.4 12.2.0 | 1 |
| openmined/ | b72f74a68b32 | pillow | 12.2.0 | 1 |
| pangeo/ | 5fbe688a4f80 | pillow | 12.2.0 | 1 |
| pschiffe/ | 37ebba8c2b8f | pillow | 12.2.0 | 1 |
| psono/ | 3b974b43ea03 | pillow | 12.2.0 | 1 |
| rdavidoff/ | 7ae4c5135771 | pillow | 12.2.0 | 1 |
| robmarkcole/ | 410275726459 | pillow | 12.2.0 | 1 |
| rommapp/ | b909e95d1aab | pillow | 12.2.0 | 1 |
| saidsef/ | f17f7c435891 | pillow | 12.2.0 | 1 |
| scrapinghub/ | a5f89bc84606 | pillow | 12.2.0 | 1 |
| seafileltd/ | 6693911bcc40 | pillow | 12.2.0 | 1 |
| seafileltd/ | 70628f29c663 | pillow | 12.2.0 | 1 |
| seafileltd/ | 7ac833196f60 | pillow | 12.2.0 | 1 |
| seafileltd/ | d0c66e4621bd | pillow | 12.2.0 | 1 |
| seafileltd/ | ed0fcda5e6a9 | pillow | 12.2.0 | 1 |
| sirrend/ | 699e79e3d4e2 | pillow | 12.2.0 | 1 |
| sirrend/ | 7ca688c7abf5 | pillow | 12.2.0 | 1 |
| sruthitanneru/ | e565ea454ffd | pillow | 12.2.0 | 1 |
| szurubooru/ | accf2ad9fbc3 | pillow | 12.2.0 | 1 |
| tachyongroup/ | f4f7fabe1037 | pillow | 12.2.0 | 1 |
| taigaio/ | 9f97323cc150 | pillow | 12.2.0 | 1 |
| timescale/ | e8d0a9cc3db5 | pillow | 12.2.0 | 1 |
| timothyclarke/ | 22c41e5ca7e2 | pillow | 12.2.0 | 1 |
| timothyclarke/ | 40a80ced8031 | pillow | 12.2.0 | 1 |
| vabene1111/ | 0f8d061895e9 | pillow | 12.2.0 | 1 |
| vabene1111/ | ec4e9e2905b0 | pillow | 12.2.0 | 1 |
| weblate/ | 82848df56ecd | pillow | 12.2.0 | 1 |
| yuzutech/ | 7c1917c66d96 | pillow | 12.2.0 | 1 |
| zurdi15/ | 2db88fe44c89 | pillow | 12.2.0 | 1 |
| gcr.io/ | 25d6975951f1 | pillow | 12.2.0 | 1 |
| ghcr.io/ | ab63d26a8a2c | pillow | 12.2.0 | 1 |
| ghcr.io/ | 22e3d0b486df | pillow | 12.2.0 | 1 |
| ghcr.io/ | 7a5244e4c8dc | pillow | 12.2.0 | 1 |
| ghcr.io/ | c862771e38e8 | pillow | 12.2.0 | 1 |
| ghcr.io/ | 6b64d194a27d | pillow | 12.2.0 | 1 |
| ghcr.io/ | a2be95de450c | pillow | 12.2.0 | 1 |
| ghcr.io/ | 870e396fddf8 | pillow | 12.2.0 | 1 |
| ghcr.io/ | 080150de7d86 | pillow | 12.2.0 | 1 |
| ghcr.io/ | f53bde3acd4f | pillow | 12.2.0 | 1 |
| ghcr.io/ | e59ebde55709 | pillow | 12.2.0 | 1 |
| ghcr.io/ | 22ae556e0de4 | pillow | 12.2.0 | 1 |
| ghcr.io/ | 84d09c6b75a7 | pillow | 12.2.0 | 1 |
| ghcr.io/ | a5c1daef46c0 | pillow | 12.2.0 | 1 |
| ghcr.io/ | 26c51e44d932 | pillow | 12.2.0 | 1 |