Stirling Pdf CVE-2026-33438

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a score of 6.5, indicating Medium to High severity with network accessibility, low attack complexity, and requirement for low-level authentication privileges. The SSVC framework indicates exploitation is poc-available (not actively exploited per CISA KEV data), is not automatable in a widespread fashion, and causes partial technical impact. The authentication requirement (PR:L) significantly restricts real-world attack surface compared to unauthenticated vulnerabilities, as attackers must first gain valid user credentials or compromise an authenticated session. The combination of moderate CVSS score, confirmed proof-of-concept availability, authentication gate, and vendor patch availability suggests this is a legitimate but contained priority-organizations with internet-exposed Stirling-PDF instances allowing multiple authenticated users face elevated risk, while isolated internal deployments with restricted access face lower practical risk.

An authenticated user with valid credentials to a Stirling-PDF instance crafts a POST request to /api/v1/security/add-watermark with fontSize and widthSpacer parameters set to extremely large values (e.g., Integer.MAX_VALUE or equivalent), causing the rendering engine to allocate excessive memory and CPU cycles in an attempt to render the watermark. The server exhausts available resources, becomes unresponsive, and crashes, disrupting PDF processing for all users. Because proof-of-concept code exists and the endpoint requires authentication, an attacker would need either stolen credentials, compromised user accounts, or an insider threat to execute this attack.