QSN-8690-1: Pillow vulnerability
2026-09-01

Summary:
Pillow could be made to crash or expose sensitive information if it
processed a specially crafted image file.

Details:
It was discovered that Pillow did not properly manage memory when
processing certain image files. An attacker could possibly use this  issue
to cause a denial of service or read sensitive data.

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-pil 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.9.1.001 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.9.0.464 jammy: python3-pil 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.9.0.464 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.8.6.015 jammy: python3-pil 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.8.6.015 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.5 (fixed in 9.0.1-1ubuntu0.5)
  6.8.5.018 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.5.018 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.4.038 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.4.038 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.3.018 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.3.018 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.2.002 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.2.002 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.1.007 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.1.007 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.0.205 jammy: python3-pil 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)
  6.8.0.205 jammy: python3-pil.imagetk 9.0.1-1ubuntu0.4 (fixed in 9.0.1-1ubuntu0.5)

CVEs: CVE-2026-59198

References:
  https://ubuntu.com/security/notices/USN-8690-1