CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112898

The Pillow Python imaging library (versions 9.1.0 through 12.x.x ) is vulnerable to an information disclosure flaw in the Image.quantize() function. When an empty palette is used, the ImagingPaletteCacheUpdate() function fails to initialize a local cache array, leading the conversion path to emit...

CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112897

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112897

The Pillow Python imaging library (versions 5.3.0 through 13.0.0 ) is vulnerable to an issue where it can return uninitialized memory as pixels. This occurs when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. Specifically, the _decodeStrip and _decodeTile buffers may...

CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112897

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112896

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved...

CVE-2026-112896

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved...

CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

CVE-2026-112893

The Pillow Python imaging library versions 10.0.0 through 13.0.0 are vulnerable to a memory corruption issue during FreeType rendering when using an active stroker. If the FT_Load_Glyph function fails, the cleanup process may incorrectly call FT_Done_Glyph on an uninitialized or stale glyph varia...

CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

grafana: grafana: Denial of Service via oversized Git Sync responses

A flaw was found in Grafana. A malicious or compromised Git server configured for Git Sync provisioning can return oversized or highly compressed responses, causing uncontrolled memory consumption. This issue can exhaust system memory, resulting in a Denial of Service DoS condition on the Grafana...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...