Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by GitHub_M

CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Medium 6.3

In plain English

A medium-severity security flaw in Pillow from python-pillow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 69.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pillowno fix listedDEBIAN-CVE-2026-114501
Debian:13pillowno fix listedDEBIAN-CVE-2026-114501
Debian:14pillowno fix listedDEBIAN-CVE-2026-114501
PyPIpillow13.0.0PYSEC-2026-4336
PyPIpillow13.0.0GHSA-654x-cwwv-5j9c
Ubuntu:26.04:LTSpillowno fix listedUBUNTU-CVE-2026-114501
Ubuntu:26.10pillowno fix listedUBUNTU-CVE-2026-114501

Affected products (as reported)

VendorProductVersions
python-pillow Pillow >= 11.2.1, < 13.0.0

Weakness: CWE-226, CWE-908 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References