Pillow Heap Buffer Overflow Vulnerability in Coordinate Handling

A heap buffer overflow vulnerability has been identified in the Python imaging library Pillow, specifically in versions 11.2.1 prior to 12.2.0. The issue arises when nested lists are passed as coordinates to certain APIs, including ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line. The nested lists were recursively unpacked beyond the limits of the allocated buffer, leading to the overflow. This vulnerability has been addressed in version 12.2.0, where coordinate lists are now properly validated to ensure they contain exactly two numeric coordinates.

Impact

Exploitation of this vulnerability could lead to a heap buffer overflow, a type of memory corruption that can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Users can upgrade to Pillow version 12.2.0 to address this vulnerability.