CVE-2026-112898

A flaw was found in Pillow. When processing an image with an empty palette during color quantization, internal stack memory is left uninitialized and emitted into the output image data. An attacker who supplies a crafted palette image can exploit this vulnerability to read uninitialized memory contents from the resulting image file, leading to information disclosure.

Red Hat rates this vulnerability as Moderate because it is confined to localized memory leakage and cannot be leveraged directly for service interruption or arbitrary code execution. Exploitation requires an application to ingest user-supplied color maps and pass them into quantization routines, then return the generated graphic to the requester. In standard Red Hat product deployments, integrated imaging tasks rarely allow external users to control color quantization palettes, thereby substantially restricting real-world attack vectors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.