CVE-2026-112898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112898
Aliases
Downstream
CGA (4)
DEBIAN (1)
Published
2026-10-19T22:04:23Z
Modified
2026-10-21T09:40:07Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Details

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-457"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112898.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "9.1.0"
                        },
                        {
                            "fixed":  "13.0.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "13.0.0"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13943c8f857b22f073d30f0ef9b725a0d255f1a4
Fixed
293218ad059d994baf1777d882911bed6a49704a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "13943c8f857b22f073d30f0ef9b725a0d255f1a4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "13.0.0",
            "range":  [
                {
                    "fixed":  "293218ad059d994baf1777d882911bed6a49704a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0
1.2
1.7.7
1.7.8
10.*
10.0.0
10.1.0
10.2.0
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0
12.2.0
12.3.0
2.*
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.5.0
2.7.0
2.8.0
2.8.1
2.9.0
2.9.0.dev0
2.9.0.dev1
2.9.0.dev2
3.*
3.1.0
3.1.0-rc1
3.2.0
3.3.0
3.4.0
4.*
4.0.0
4.0.0a
4.1.0
4.2.0
4.3.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
6.*
6.0.0
6.1.0
6.2.0
7.*
7.0.0
7.1.0
7.2.0
8.*
8.0.0
8.1.0
8.2.0
8.3.0
8.4.0
9.*
9.0.0
9.1.0
9.2.0
9.3.0
9.4.0
9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112898.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "64108318206639666815424483956828943958",
                "203478171462009310820595205303109258348",
                "51351072268465345210411290637908837318",
                "3260753264857892152352648858719437662"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112898-3334ecae",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4",
        "target":  {
            "file":  "src/libImaging/Palette.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "276934406080909449386726116059133482640",
            "length":  3959
        },
        "id":  "CVE-2026-112898-41a94e0b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4",
        "target":  {
            "file":  "src/libImaging/Convert.c",
            "function":  "topalette"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "280077821003386202678798593690614379617",
                "181988336518122522150948398463457815506",
                "162116776869138630329927556964185418085",
                "170824228033395107541519754029559127055"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112898-8601d08c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4",
        "target":  {
            "file":  "src/libImaging/Convert.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "241220436387449744572076761200666681709",
            "length":  2452
        },
        "id":  "CVE-2026-112898-f2535f92",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4",
        "target":  {
            "file":  "src/libImaging/Palette.c",
            "function":  "ImagingPaletteCacheUpdate"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:40:07Z"