Pillow versions from 11.2.1 through before 12.2.0 accepted nested lists as coordinates for APIs such as ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line. The library recursively unpacked these nested lists beyond the allocated buffer, causing a heap buffer overflow (CWE‑122). This overflow could corrupt memory, and a crafted image may lead to code execution if the application runs with elevated privileges. Version 12.2.0 patches the issue by validating coordinate lists to contain exactly two numeric values, preventing the overflow.

The vulnerability affects the Python imaging library Pillow, maintained by python‑pillow. Any installations using versions 11.2.1 up to 12.1.x are susceptible. Systems that load untrusted image files with Pillow without additional validation are at risk.

Based on the description, it is inferred that the likely attack vector involves an attacker supplying a malicious image file with nested list coordinates, either during local image processing or via an upload service that forwards the image to Pillow. The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, indicating a low likelihood of widespread exploitation. Successful exploitation could corrupt memory and potentially allow arbitrary code execution, depending on the target environment.