GHSA-654X-CWWV-5J9C Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Summary When PILLOWALIGNMENT is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. Details With an alignment above 1, the default allocator pads each row up to alignedlinesi...

EUVD-2026-107575

Pillow: Arrow export leaks stale heap memory when PILLOWALIGNMENT 1...

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Summary When PILLOWALIGNMENT is set above 1, exporting an image to Arrow returns uninitialized heap memory mixed in with the pixel data. That memory can include pixels from images the process freed earlier. Details With an alignment above 1, the default allocator pads each row up to alignedlinesi...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow ex...

SUSE CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

A flaw was found in Pillow. This vulnerability can lead to information disclosure when exporting images to Apache Arrow format with memory alignment enabled, as the library assumes image rows are contiguous in memory. Consequently, exported buffers may incorporate uninitialized padding or residua...

Linux Distros Unpatched Vulnerability : CVE-2026-114501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr...

DEBIAN-CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

The Pillow Python imaging library (versions 11.2.1 through 13.0.0 ) contains a memory disclosure vulnerability during Arrow export . When PIOLLOW_ALIGNMENT is greater than 1, the library incorrectly assumes rows are tightly contiguous, exporting from an offset that may include uninitialized paddi...

CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

PT-2026-120826

Name of the Vulnerable Software and Affected Versions Pillow versions 11.2.1 through 12.x Description Arrow export assumes image rows are tightly contiguous and exports from im-blocks0.ptr, ignoring cases where PILLOW ALIGNMENT causes aligned linesize to include row padding or an aligned offset...

CLSA-2026-1792499609 TuxCare security update for @babel/plugin-transform-arrow-functions (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-arrow-functions to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792499608 TuxCare security update for @babel/plugin-transform-arrow-functions (1 CVE)

TuxCare rebuilt @babel/plugin-transform-arrow-functions to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792499602 TuxCare security update for @babel/plugin-transform-arrow-functions (1 CVE)

TuxCare rebuilt @babel/plugin-transform-arrow-functions to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792499600 TuxCare security update for @babel/plugin-transform-arrow-functions (1 CVE)

TuxCare rebuilt @babel/plugin-transform-arrow-functions to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

External Control of System or Configuration Setting

Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwar...