Pillow versions from 11.2.1 up to but not including 13.0.0 have a vulnerability in the Arrow export feature where stale heap memory can be leaked due to incorrect handling of image row alignment. This can cause uninitialized or previously freed memory to be included in the exported Arrow buffer, potentially disclosing sensitive data between users. The issue is fixed in version 13.0.0.