CVE-2026-114501

MEDIUM

6.3

CVSS v4

Description

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.

CWE-226 CWE-908

How to fix

Remediation Available

pillowDebian

Fixed in:13.0.0-1CVE-2026-114501

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v4 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

Impact

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit Intelligence

0.38%probability of exploitation in 30 days

31stpercentile

Low risk: more likely to be exploited than 31% of all known CVEs.

References

Other references4

Related Vulnerabilities

Other CWE-226 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2020-27218	Medium	4.8	8.3%	-	Fix
CVE-2018-7166	High	7.5	2.8%	-	Fix
CVE-2022-39393	High	8.6	0.8%	-	Fix
CVE-2026-92708	High	7.5	0.7%	-	Fix
CVE-2026-5795	High	7.4	0.6%	-	Fix
CVE-2024-32036	Medium	5.3	0.6%	-	Fix

Common questions

How do I fix CVE-2026-114501?

Upgrade pillow on debian unstable to 13.0.0-1 or later.

Is CVE-2026-114501 being actively exploited?

Not that we know of. CVE-2026-114501 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.38% is the estimated probability that it will be exploited in the next 30 days. That is higher than 31% of all scored CVEs.

How severe is CVE-2026-114501?

CVE-2026-114501 has a CVSS v4 base score of 6.3, rated medium. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-114501 affect?

Published advisories record a fix for pillow (Debian). Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.

Embed a live status badge for CVE-2026-114501

Markdown

[![CVE-2026-114501](https://tridentstack.com/cve/badge/CVE-2026-114501.svg)](https://tridentstack.com/cve/CVE-2026-114501)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-114501"><img src="https://tridentstack.com/cve/badge/CVE-2026-114501.svg" alt="CVE-2026-114501"></a>

Check your Linux endpoints for this class of vulnerability

TridentStack Control continuously scans Linux endpoints for known vulnerabilities and deploys the fixes from the same console. 200 endpoints free forever, no credit card.

Patch your fleet free Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-10-22.