CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

EUVD-2026-104660

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112898

The Pillow Python imaging library (versions 9.1.0 through 12.x.x ) is vulnerable to an information disclosure flaw in the Image.quantize() function. When an empty palette is used, the ImagingPaletteCacheUpdate() function fails to initialize a local cache array, leading the conversion path to emit...