CVE-2026-112898 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the Pillow Python imaging library represents a significant information disclosure risk stemming from improper initialization of local variables during image processing operations. Specifically affecting versions ranging from 9.1.0 through 13.0.0, this flaw is located in the Image.quantize() function when it processes images with an empty palette. The core technical defect lies within the ImagingPaletteCacheUpdate() routine, which fails to initialize a local cache array if the associated palette contains zero entries. In standard software development practices, local variables allocated on the stack are not automatically cleared of previous data; they retain whatever values were previously stored at that memory location until explicitly overwritten. By leaving this array uninitialized, Pillow inadvertently preserves stale data from prior function calls or other parts of the program execution context.
When an attacker controls the input palette image and triggers a conversion path such as PNG or GIF encoding, the system proceeds to emit these uninitialized bytes as output pixel indices rather than handling the empty state gracefully with zeros or an error code. This behavior allows for the direct leakage of stack memory contents into the resulting file data. Because the vulnerability relies on reading existing stack memory without modifying it, it avoids triggering common security mechanisms that detect out-of-bounds reads or buffer overflows. Consequently, this flaw does not result in memory corruption, process crashes, or arbitrary code execution vulnerabilities typically associated with more severe heap or stack-based exploits. Instead, it serves purely as a side-channel information leak vector that can expose sensitive internal state data to external observers.
The operational impact of this vulnerability is primarily centered on the exposure of critical security metadata and architectural details. The leaked uninitialized memory often contains return addresses, local variable values from previous operations, and potentially stack-canary data used by compilers to detect buffer overflows. Disclosure of stack canaries allows attackers to bypass a primary defense mechanism against exploitation attempts in other parts of an application or system that utilizes Pillow for image processing. Furthermore, the leakage of memory addresses aids in defeating Address Space Layout Randomization, making subsequent exploitation efforts more predictable and feasible if combined with other vulnerabilities. This type of information disclosure is particularly dangerous in server-side applications where Pillow processes user-uploaded images, as it provides attackers with a foothold to map out the target environment without direct interaction or error feedback.
From a classification perspective, this vulnerability aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-457: Use of Uninitialized Variable. The attack vector is consistent with ATT&CK technique T1083: File and Directory Discovery if the leaked data aids in further reconnaissance, or more accurately T1608: Stage Capabilities via information gathering that facilitates later stages of an intrusion campaign. Mitigation strategies require immediate upgrading to version 13.0.0 or later where this initialization defect has been resolved by ensuring all palette cache arrays are properly zeroed out before use regardless of palette entry count. For environments unable to upgrade immediately, input validation should be implemented to reject images with empty palettes prior to quantization processing, thereby preventing the execution path that triggers the uninitialized memory read.