CVE-2026-112898

Affected versions of the Pillow package are vulnerable to Use of Uninitialized Variable due to a stack-allocated buffer being copied into a result without being fully populated. The `ImagingPaletteCacheUpdate()` function in `src/libImaging/Palette.c` declares a local `UINT8 c[512]` array that is only written inside a loop bounded by `palette->size`, but when `Image.quantize(palette=...)` is called with a zero-entry palette (producible via a PNG with an empty `PLTE` chunk, a colour-mapped TGA with a zero-length colour map, or a bare `Image.new("P", ...)`), the loop body never executes, leaving `c[]` uninitialized before it is copied into the colour cache and subsequently emitted as output pixel indices by `topalette()` in `src/libImaging/Convert.c`, since that function only rejects a `NULL` palette and not one with `size == 0`. An attacker who controls the palette image supplied to `Image.quantize(palette=...)` — for example through a palette-swap or pixel-art upload feature — can retrieve up to 512 bytes of the worker process's uninitialized stack memory encoded as pixel values in the returned image, potentially disclosing stack addresses, heap/libc/libpython pointers, and the stack-protector canary, which can aid in bypassing ASLR and stack protections in a long-lived server process.