The python-pillow Pillow library versions >= 11.2.1 and < 12.2.0 contain a heap-based buffer overflow vulnerability (CWE-122) triggered by passing nested lists as coordinates to APIs that accept coordinate inputs. The recursive unpacking of these nested lists can exceed the allocated buffer size, causing memory corruption. The vulnerability affects APIs including ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line. The issue is fixed in version 12.2.0 by enforcing validation that coordinate lists contain exactly two numeric values.

Exploitation of this vulnerability could lead to heap memory corruption due to buffer overflow when processing malformed coordinate inputs. This may result in application crashes or potentially arbitrary code execution depending on the context. The CVSS 4.0 base score is 5.1 (medium severity), reflecting local attack vector and low complexity without user interaction required. No known exploits in the wild have been reported.

Upgrade to python-pillow Pillow version 12.2.0 or later, where the vulnerability is patched by validating coordinate inputs. Until upgrade, avoid passing nested lists as coordinates to the affected APIs. Patch status is confirmed by the vendor's versioning information indicating the fix in 12.2.0.