Uninitialized Stack Memory Vulnerability in Pillow Python Imaging Library by Python Software Foundation
CVE-2026-112898
What is CVE-2026-112898?
The Pillow Python Imaging Library, specifically versions 9.1.0 through 13.0.0, contains a vulnerability that can lead to the disclosure of uninitialized stack memory when the Image.quantize() function is called with an empty palette. The ImagingPaletteCacheUpdate() function fails to initialize a local cache array in scenarios where the palette comprises zero entries. As a consequence, the library may inadvertently return sensitive stack content such as memory addresses and stack-canary values through PNG or GIF outputs, enabling potential attackers to extract these details without exploiting out-of-bounds accesses, corrupting memory, or causing process crashes. The vulnerability has been rectified in version 13.0.0.
Affected Version(s)
Pillow >= 9.1.0, < 13.0.0