Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-114501 BIT-pillow-2026-114501EUVD-2026-107575GHSA-654x-cwwv-5j9cPYSEC-2026-4336

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Published Oct 21, 2026 · Updated Oct 30, 2026 · Assigned by GitHub_M

Description

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

Affected products

VendorProductAffectedFixed
python-pillow Pillow >= 11.2.1, < 13.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pillow No fix yet —
Debian 13 pillow No fix yet —
Debian 12 pillow No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pillow 12.3.0-1ubuntu2 USN-9064-1
Ubuntu 26.04 LTS pillow 12.1.1-2ubuntu1.5 USN-9064-1
Ubuntu 24.04 LTS pillow 10.2.0-1ubuntu1.5 USN-9064-1
Ubuntu 22.04 LTS pillow 9.0.1-1ubuntu0.7 USN-9064-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS pillow 7.0.0-4ubuntu0.9+esm2 USN-9064-1
Ubuntu Pro 20.04 LTS pillow-python2 No fix yet —
Ubuntu Pro 18.04 LTS pillow 5.1.0-1ubuntu0.8+esm3 USN-9064-1
Ubuntu Pro 16.04 LTS pillow 3.1.2-0ubuntu1.6+esm4 USN-9064-1
Ubuntu Pro 14.04 LTS pillow 2.3.0-1ubuntu3.4+esm6 USN-9064-1
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
SLES 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 python-Pillow 11.3.0-160000.9.1 openSUSE-SU-2026:22246-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling open-webui +1 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pillow >= 11.2.1, < 13.0.0 13.0.0 GHSA-654x-cwwv-5j9c

Advisories 3

References