CVE-2026-112898

The record

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.

Affected packages

Related vulnerabilities

• CVE-2026-112893 Pillow is a Python imaging library. CWE-457
• CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. CWE-457
• CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through… CWE-457
• CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized memory to… CWE-457
• CVE-2026-78935 Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65… CWE-457
• CVE-2026-62986 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-457
• CVE-2026-76919 ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of… CWE-457
• CVE-2026-17077 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… CWE-457