Pillow versions from 11.2.1 through before 12.2.0 accepted nested lists as coordinates for APIs such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line. The library unpacked these nested lists recursively beyond the allocated buffer, causing a heap buffer overflow (CWE‑122) and mismatched buffer sizes (CWE‑131). The overflow could corrupt memory, potentially leading to application crashes or data corruption, but no direct mention of code execution is stated in the official description.

The vulnerability affects the Python imaging library Pillow maintained by python‑pillow. Any installation using Pillow versions between 11.2.1 and the last pre‑12.2.0 release is susceptible. Systems that process untrusted image files with Pillow without additional validation are at risk.

The likely attack vector involves an attacker providing a malicious image file containing nested list coordinates, either during local image processing or via an upload mechanism that forwards the image to Pillow. The CVSS score of 5.1 indicates moderate severity. The EPSS score of less than 1% and the lack of listing in the KEV catalog suggest a low likelihood of widespread exploitation. Successful exploitation could cause memory corruption and application instability, depending on the target environment.