Python Pillow EUVD-2026-104649

Exploitation requires an application built on Pillow 9.2.0 up to (but not including) 13.0.0 that accepts an attacker-supplied input image and saves/re-encodes it as GIF while retaining the embedded comment from the untrusted source. The specific trigger is a GIF (or convertible image) carrying a very large comment extension block, which drives the quadratic copy loop in _get_global_header(). The practical limiting factor is the save-as-GIF-with-comment workflow: services that never output GIF, or that strip comments before saving, are not affected. No authentication or user interaction is needed per the vector (PR:N/UI:N), but the vulnerable code path must actually be reachable with attacker-controlled comment data.

This is a genuine but moderate-severity availability issue, not a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with only VA:L and no confidentiality/integrity impact correctly characterizes it as an algorithmic-complexity denial of service (CWE-407): quadratic copying in GIF _get_global_header() when a large comment is present. No EPSS score, KEV listing, or POC was provided, so the exploitation signal is weak - this maps to 'no public exploit identified at time of analysis.' The score of 6.9 is driven purely by easy network reachability, not by impact depth: the worst realistic outcome is CPU exhaustion / slow or denied service for the processing worker, with no code execution or data exposure. Note a tag/impact conflict: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (VC:N, VI:N, VA:L) and the description - this is strictly an availability/DoS flaw, so the 'Information Disclosure' tag appears mislabeled and should be disregarded. Priority should be driven by whether an exposed application actually re-saves untrusted images as GIF.

An attacker uploads an image containing an oversized GIF comment to a web service that uses Pillow to re-encode or save user-supplied images as GIF. During save, _get_global_header() repeatedly copies the retained comment data, producing quadratic CPU cost that stalls the worker and degrades or denies service for other users. No public exploit code was identified, but the trigger is trivial to construct from the public description and commit.