CVE-2026-112898 with a CVSS score of 6.9 is a memory disclosure vulnerability in the Pillow image library, specifically in the Image.quantize() function when it is called with an empty palette. The flaw allows uninitialized stack memory to be leaked, creating a condition where data that was not explicitly cleared or initialized can be exposed to an attacker. The vulnerability is reachable over a network with low attack complexity and does not require authentication, special privileges, or user interaction, meaning an attacker can potentially trigger the unsafe code path by causing the quantization operation to run with an empty palette. Because the leaked memory originates from the stack, it may contain residual values from prior operations, including sensitive application data, configuration fragments, or other process-local information. The business impact is primarily confidentiality, as unauthorized disclosure of stack contents can reveal internal state, credentials, tokens, or other sensitive values that an application handled in memory. This can undermine trust in image-processing services, enable further reconnaissance, and increase the risk of follow-on compromise if exposed data is useful to an attacker. No affected version range is stated, so the exact Pillow versions impacted cannot be confirmed.
We recommend you to update Pillow to version 13.0.0.[/subscribe_to_unlock_form]
CVE-2026-112898 with a CVSS score of 6.9 is a memory disclosure vulnerability in the Pillow image library, specifically in the Image.quantize() function when it is called with an empty palette. The flaw allows uninitialized stack memory to be leaked, creating a condition where data that was not explicitly cleared or initialized can be exposed to an attacker. The vulnerability is reachable over a network with low attack complexity and does not require authentication, special privileges, or user interaction, meaning an attacker can potentially trigger the unsafe code path by causing the quantization operation to run with an empty palette. Because the leaked memory originates from the stack, it may contain residual values from prior operations, including sensitive application data, configuration fragments, or other process-local information. The business impact is primarily confidentiality, as unauthorized disclosure of stack contents can reveal internal state, credentials, tokens, or other sensitive values that an application handled in memory. This can undermine trust in image-processing services, enable further reconnaissance, and increase the risk of follow-on compromise if exposed data is useful to an attacker. No affected version range is stated, so the exact Pillow versions impacted cannot be confirmed.
We recommend you to update Pillow to version 13.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]