Pillow is a Python imaging library that calculates text widths by adding signed glyph advance values to a cumulative size. The implementation checks that a glyph’s advance is not greater than the maximum positive 32‑bit integer, but it fails to verify that a negative advance does not fall below the minimum negative 32‑bit integer. When an attacker repeatedly supplies the signed 16‑bit value –32768, the addition overflows, producing a large positive result from a negative mathematical value. This integer overflow can affect any Pillow API that reports text dimensions, such as getlength() or getsize(), and can be used to break layout, quota, or allocation logic, leading to resource exhaustion or incorrect behavior. The high‑level mask path in Pillow preserves a decompression‑bomb check, so the overflow is not mitigated there.

Python software that depends on the Pillow imaging library, particularly versions prior to 13.0.0 of Pillow.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. No EPSS score is available, and the issue is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw requires specific controlled glyph advances, an attacker must supply crafted image data that exercises the vulnerable code path. From the description, the most likely attack vector is through processing user‑supplied images; an attacker could embed a file that forces the overflow, then trigger an API that reads the corrupted width. If the vulnerability is exploited in a high‑traffic application, the resulting logic integrity error could lead to denial of service or corruption of downstream data structures.