Multiple Pillow Vulnerabilities Affect Ubuntu Users

On June 8, 2026, Ubuntu released USN-8399-1 addressing several vulnerabilities in the Pillow library. These vulnerabilities could allow attackers to exploit large glyph advance values, nested coordinate lists, and malformed PDF and PSD files, potentially leading to denial of service attacks. The affected versions include Ubuntu 25.10 and Ubuntu 26.04 LTS. Specific CVEs include CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, and CVE-2026-42311, all published on May 9, 2026. Users are advised to update their systems to mitigate these risks. The vulnerabilities could allow excessive resource usage or crashes, impacting service availability. The issues highlight the importance of timely software updates for maintaining security.

Key Points: • Pillow vulnerabilities could lead to denial of service attacks on affected Ubuntu versions. • CVE-2026-42308, CVE-2026-42309, CVE-2026-42310, and CVE-2026-42311 were published on May 9, 2026. • Users of Ubuntu 25.10 and 26.04 LTS are urged to update their systems immediately.