Tetrak
GitHub ↗
Security · Pillow

Image.quantize with an empty palette returns uninitialised stack memory

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Advisory
CVE-2026-112898
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Image.quantize(palette=...) with a palette image that has no palette.

What sillybos does

Refused with a setting

sillybos refuses the triggering file when the policy says so (Policy(png_colour_types=frozenset({"greyscale", "rgb", "greyscale-alpha", "rgba"}))); the default policy lets it through.

The trigger is a palette image with no entries, handed to Image.quantize as the palette, and a file can carry it: an 80-byte PNG with an empty PLTE chunk, opened with Image.open, is one of the three ways the upstream report names (a colour-mapped TGA with no entries is another, refused by name; Image.new is the third). The program has to let a file from outside be the palette image. The reader does not open the PLTE, so the default passes such a file; a scans-only policy without palette PNGs refuses it before Pillow sees it. Refusing an empty PLTE by default, as the PNG specification's one-to-256 entries would justify, would be a new default refusal and so a breaking change for a later release.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-bucketed on 2026-11-03: a file can carry the empty palette, and a setting refuses it.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Never let a file from outside be the palette image for quantize; where it must be, run the check on it under a policy without palette PNGs; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources