EUVD-2026-107575

Pillow: Arrow export leaks stale heap memory when PILLOWALIGNMENT 1...

CVE-2026-115386

A flaw was found in Wasmtime. An information disclosure vulnerability exists in the WebAssembly System Interface WASI directory reading implementation, which copies uninitialized structure padding into guest memory. A guest module with access to a preopened directory can exploit this issue by...

CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fdreaddir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of...

CVE-2026-115386

The Wasmtime runtime contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation affecting versions before 36.0.17 , 37.0.0 before 48.0.4 , and 49.0.0 before 49.0.2 . The root cause is the copying of uninitialized struct padding into guest memory. Consequently, guests...

SUSE CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

A flaw was found in Pillow. This vulnerability can lead to information disclosure when exporting images to Apache Arrow format with memory alignment enabled, as the library assumes image rows are contiguous in memory. Consequently, exported buffers may incorporate uninitialized padding or residua...

Linux Distros Unpatched Vulnerability : CVE-2026-114501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr...

DEBIAN-CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

PT-2026-120826

Name of the Vulnerable Software and Affected Versions Pillow versions 11.2.1 through 12.x Description Arrow export assumes image rows are tightly contiguous and exports from im-blocks0.ptr, ignoring cases where PILLOW ALIGNMENT causes aligned linesize to include row padding or an aligned offset...

Red Hat: CVE-2026-114501: pillow: Pillow: Information disclosure via improper memory alignment during Arrow export

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: evdev – fixed an issue related to information leakage in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. O...

RUSTSEC-2026-0323 fd_readdir copies uninitialized struct padding into guest memory

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory...

CVE-2026-91946

A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server's ResetGraphics Protocol Data Unit PDU serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of...

DEBIAN-CVE-2026-91946

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...

CVE-2026-91946 FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...

CVE-2026-91946 FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...

EUVD-2026-78803

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function...