CVE-2026-114501

A flaw was found in Pillow. This vulnerability can lead to information disclosure when exporting images to Apache Arrow format with memory alignment enabled, as the library assumes image rows are contiguous in memory. Consequently, exported buffers may incorporate uninitialized padding or residual data from previously freed process memory. An attacker could exploit this flaw to obtain sensitive process memory or image data belonging to other users.

This vulnerability is rated as having a Low impact because exploitation depends on non-default memory alignment configurations combined with image conversion to Apache Arrow, limiting exposure to specialized multi-tenant pipelines. Standard Red Hat software components and default workflows do not enable custom memory alignment during image transfers. Furthermore, the risk is strictly restricted to information disclosure of residual heap data or uninitialized padding within the process without providing arbitrary code execution or data modification capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.