CVE-2026-112898: Pillow Image.quantize() Stack Memory Leak Vulnerability
Summary
CVE-2026-112898: Pillow: Image.quantize() with empty palette leaks uninitialized stack memory. Affects pillow versions >= 9.1.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It supports operations such as image filtering, transformation, and color management. However, a vulnerability has been identified in the Image.quantize() function, which allows users to supply a palette image. This vulnerability can lead to uninitialized stack memory being leaked, posing a security risk to applications using Pillow.
Vulnerability Detail
The vulnerability arises from the Image.quantize() function when an empty palette is provided. Specifically, in the ImagingPaletteCacheUpdate() function, a local array intended to store color indices is not initialized when the palette size is zero. As a result, the function inadvertently returns uninitialized stack memory as pixel values. This can lead to the disclosure of sensitive information, including memory addresses and stack canary values, without causing a crash or generating log entries. The issue was introduced in commit 54cb09d8b48c and affects versions starting from 9.1.0.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using an empty palette with the Image.quantize() function. Ensure that the palette provided has at least one entry to prevent the exposure of uninitialized memory.
Conclusion
The CVE-2026-112898 vulnerability in the Pillow library poses a significant risk by allowing uninitialized stack memory to be leaked through the Image.quantize() function when an empty palette is used. It is crucial to update to the patched version 13.0.0 or later to mitigate this risk and ensure the security of applications utilizing Pillow.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112898 is a vulnerability in the Pillow library that allows uninitialized stack memory to be leaked when using the Image.quantize() function with an empty palette.
If your application allows users to supply a palette image for quantization, it may inadvertently expose sensitive information from the server's memory, including memory addresses and canary values.
The vulnerability affects Pillow versions starting from 9.1.0 up to but not including 13.0.0.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
