{"id":"CVE-2026-114501","summary":"Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT \u003e 1","details":"Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-\u003eblocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.","aliases":["GHSA-654x-cwwv-5j9c"],"modified":"2026-10-23T07:03:14.050053432Z","published":"2026-10-21T21:17:09.748Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-226","CWE-908"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114501.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114501.json"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/10172"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114501"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python-pillow/pillow","events":[{"introduced":"339bc5db93bd95decf65a59fab273f300db6594d"},{"fixed":"293218ad059d994baf1777d882911bed6a49704a"},{"fixed":"19f64946eb247b973dd4560be7dea3bf979d2e6a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"11.2.1"},{"fixed":"13.0.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"19f64946eb247b973dd4560be7dea3bf979d2e6a"}]},{"range":[{"fixed":"293218ad059d994baf1777d882911bed6a49704a"}],"source":"REFERENCES_TAG","original_tag":"13.0.0"}]}}],"versions":["12.3.0","12.2.0","12.1.0","12.0.0","11.3.0","11.2.1"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"203200701618256798612017769031103354966","length":397},"id":"CVE-2026-114501-1a08c2bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"file":"src/_imaging.c","function":"ArrowError"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"file":"src/libImaging/Arrow.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["242316132803842295169670712401841085251","65119854069139594652441119431891197595","251122170504136238495238282725204708333","164038147994078100001100383771485971049","217942500099369401996901412536737048513","78744054204527893920346949195849859800","210436059083196227980749538385703367746","335981641861991965626050165428481938398","180668052341906827630148234930482089773","143423640376859672728419823416566848843","220401019576580626091702796253157558393","238961547338641959890876316401657914772","171062184571749133358913528975874329242","297115466837831942733002933750557967031","138117622901738320082178135718093345346","113644234557443081433798187181042273583","265783736224814576390407572416923414845","39301617970635227146122628985586172553","16797875667895693006129498671967053856","267829546059839927969138010663392448733","59941783975436365114093860575149102771","177977900089367506463259019419985926527","134909360041016889015494085844130282219","186997626189777833186179143940883432049","275635292406797897423229644790674579189","73656766553335530919609568102083443104","27901666894586084076726722975511107433","89563150636015931350846763966247934639","139581753588753919056644642363266855747","220401019576580626091702796253157558393","238961547338641959890876316401657914772","171062184571749133358913528975874329242","297115466837831942733002933750557967031","138117622901738320082178135718093345346","113644234557443081433798187181042273583","265783736224814576390407572416923414845","31621042458187038398483450923272587943","101894482616938650826355257570840139992","217437512556074343137129288767200192410","118523362477286818222677750096742511131","295967971268592709290849298699448221197","106060223504992160173793753507031695332","106693062790397983530272811043994700770"]},"id":"CVE-2026-114501-9b953ea4","signature_type":"Line"},{"id":"CVE-2026-114501-a86df97c","signature_type":"Line","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"file":"src/_imaging.c"},"deprecated":false,"digest":{"line_hashes":["137338563424475035492453373766949000864","175862561366423343450406925605689606531","294961437575282144112658177788786303612","111479240700801259764189925776878676724","314665829997617269823994077621460264076","187449478947862184463699505202172834397"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"file":"src/libImaging/Arrow.c","function":"export_single_channel_array"},"deprecated":false,"digest":{"length":1055,"function_hash":"260998314215157254586793782148283353331"},"id":"CVE-2026-114501-af4d8b84"},{"source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"function":"export_imaging_schema","file":"src/libImaging/Arrow.c"},"deprecated":false,"digest":{"length":1237,"function_hash":"309353893556182977492419429213228399612"},"id":"CVE-2026-114501-bc9a1627","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"131812412858074976260848849978081465003","length":1870},"id":"CVE-2026-114501-e2594d96","signature_type":"Function","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a","target":{"file":"src/libImaging/Arrow.c","function":"export_fixed_pixel_array"},"deprecated":false}],"vanir_signatures_modified":"2026-10-23T07:03:14Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114501.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}