CVE-2026-114501Medium· 6.3▾ SunlitPillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.
Pillow >= 11.2.1, < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96637High· 7.1Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96640High· 8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96636Medium· 6.5Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CVE-2026-96642High· 7.1Pillow: TarIO negative size field causes infinite CPU-spin loop
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode