Lychee CVE-2026-77467

Requires (1) an authenticated Lychee account with permission to upload/import files, (2) ImageMagick PDF support enabled with Ghostscript as the rasterization delegate - which the advisory states Lychee enables, and (3) the ability to submit a crafted PDF whose first-page /MediaBox declares oversized dimensions relative to file size. Impact severity is modulated by deployment mode: with QUEUE_CONNECTION set to synchronous processing a single request occupies a web worker directly, whereas the official asynchronous Docker configuration instead backs up the shared image-processing queue. Limiting factors: exploitation is gated behind authentication (not anonymous), each crafted file fails eventually rather than hanging forever, and only availability is affected - there is no confidentiality, integrity, or Ghostscript sandbox-escape impact.

This is an authenticated availability-only issue (CWE-400 resource exhaustion), not a code-execution flaw - the advisory explicitly states no Ghostscript sandbox escape was identified. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, impact VA:H only, score 7.1 High) is internally consistent with the description: a network-reachable but authenticated (PR:L) attacker with low complexity can trigger it without user interaction, and the only impact is to availability (VC:N/VI:N). No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation-probability signals are absent rather than low - do not read the missing EPSS as 'safe.' Weighing the signals: the barrier is authentication plus the ability to upload a PDF, and the payoff is only degraded/delayed image processing, so this is a moderate-priority hardening fix rather than an emergency. One divergence to flag: the vendor rates VA:H, but a single crafted request only occupies one worker and eventually fails, so sustained total denial requires repeated uploads by an authenticated user - the worst-case 'H' is cumulative, which my independent assessment treats as closer to A:L (see assessed vector). Verify queue configuration (QUEUE_CONNECTION) per deployment, as synchronous processing makes the impact more immediate than the async Docker default.

An authenticated Lychee user uploads a hand-crafted PDF that is only a few hundred bytes but declares an enormous /MediaBox (e.g. 32000x32000 points). On import, ImageMagick hands the file to Ghostscript, which spends tens of seconds to minutes of CPU attempting to rasterize the oversized page before failing to produce any thumbnail. Repeating this ties up web workers (synchronous QUEUE_CONNECTION) or clogs the shared image-processing queue (async Docker config), delaying all legitimate image work. No public exploit identified at time of analysis, though the fixing PR and test samples (pdf_oversized_mediabox.pdf) effectively document the technique.