CVE-2026-114501: pillow — Fix

Description

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

Is your site exposed to CVE-2026-114501?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploit Prediction

0.0037

Probability of exploitation

0.31%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-226 CWE-226

CWE-908 CWE-908

Affected Products

Vendor	Product	Versions
python	pillow	11.2.1 — 13.0.0

References

Advisories & Patches

https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c

Other References

https://github.com/python-pillow/Pillow/pull/10172 https://github.com/python-pillow/Pillow/releases/tag/13.0.0

Frequently Asked Questions

What is CVE-2026-114501? +

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-114501? +

CVE-2026-114501 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0037, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-114501? +

CVE-2026-114501 affects products from python, specifically: pillow. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-114501? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-18023

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive …

CVE-2026-13585

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System …

CVE-2025-11602

Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of …

CVE-2026-47247 7.5

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain …

CVE-2024-38275 7.5

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be …

CVE-2026-92708 7.5

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions …

CVE-2026-114501