This vulnerability is an integer overflow that occurs when Pillow processes font files whose glyph advance values exceed large limits. The overflow arises when Pillow tracks the current position while rendering each glyph, potentially causing memory corruption, application crashes, or denial‑of‑service conditions. The issue is classified as CWE-190, an integer overflow weakness, and is mitigated in Pillow version 12.2.0 and later.

The affected product is the Python Pillow imaging library. All Pillow releases prior to 12.2.0 are vulnerable, including the 12.1.x series and earlier. Users relying on these versions should identify exactly which Pillow package they run and ensure it is updated when possible.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely used exploits have been reported. The likely attack vector is local or remote code that supplies malicious font files to an application using Pillow. Precise exploitation circumstances are not documented, but an attacker could potentially induce application instability or memory corruption by providing crafted font data.