Cloudanix VulnDB

CVE-2026-114501

Medium · 5.3

CVSS

5.3

EPSS

0.4%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in an image library can accidentally include pieces of one picture or leftover computer memory inside files sent to other people when certain alignment settings are used.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Arrow export in Pillow incorrectly assumes tightly contiguous image rows and reads from im->blocks[0].ptr even when PILLOW_ALIGNMENT introduces row padding or an offset before the first row, causing the exported buffer to contain uninitialized padding, preceding bytes, or stale heap contents from prior images.

Why it matters to the business

Organizations using Pillow for image processing with Arrow export and custom alignment face risk of unintended disclosure of image pixels or other process memory contents between users, which can violate data privacy requirements and expose sensitive visual information.

How an attack unfolds

An attacker supplies or influences images processed by an application that enables PILLOW_ALIGNMENT and performs Arrow export; the misaligned buffer read includes memory from previously freed images or padding, allowing cross-user or cross-process pixel or heap data leakage via the resulting Arrow buffer.

How to fix it

Upgrade Pillow to version 13.0.0 or later where the Arrow export logic correctly accounts for alignment-induced padding and offsets.

How to confirm the fix worked

Confirm installed Pillow version is 13.0.0 or newer; exercise Arrow export paths with PILLOW_ALIGNMENT configured and verify exported buffers contain only expected image data without extraneous padding or prior contents.

Typical attack path

  1. Identify or control an application path that loads images with PILLOW_ALIGNMENT enabled and exports to Arrow
  2. Trigger processing of multiple images in sequence to populate heap with target data
  3. Cause Arrow export of a controlled image so the buffer captures preceding or stale memory contents
  4. Retrieve the exported Arrow buffer and extract leaked pixels or memory artifacts

How to detect it

Search application and library logs for Arrow export operations performed while PILLOW_ALIGNMENT is active; inspect exported Arrow buffers or downstream consumers for unexpected non-image bytes, padding patterns, or content inconsistent with the source image dimensions.

What your security team should do

  • Immediately inventory all deployments using Pillow versions between 11.2.1 and 13.0.0 and prioritize upgrade to 13.0.0
  • Disable or avoid custom PILLOW_ALIGNMENT settings in Arrow export paths until patched
  • Review data flows that export images to Arrow for any cross-tenant or multi-user sharing scenarios

The record

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities