Pillow EUVD-2026-104657

Exploitation requires the target application to call Pillow's Image.save with PDF append enabled (append=True) against an existing PDF whose contents the attacker can influence or supply - this is the specific feature/deployment prerequisite, and applications that do not append to PDFs are unaffected. The malicious PDF must contain a deep or cyclic page tree, a long chain of unique previous-trailer offsets, or repeated non-cyclic /Kids references to defeat PdfParser's missing cycle/duplication tracking. No authentication, user interaction, or special attack condition is otherwise needed (PR:N/UI:N/AT:N). The principal limiting factor is that PDF append is a non-default, application-specific operation; impact is confined to availability (crash/hang via RecursionError or CPU/memory exhaustion) with no confidentiality or integrity consequence.

All provided signals point to an availability-only denial-of-service issue, not a code-execution or data-exposure threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vector with no required attack conditions, and sets VC:N/VI:N/VA:H - confidentiality and integrity are explicitly untouched while availability impact is High, yielding the vendor score of 8.7. CWE-674 (Uncontrolled Recursion) is consistent with the description: unbounded page-tree/trailer-chain traversal exhausts the Python stack or CPU/memory. No EPSS score, KEV listing, SSVC decision, or public POC was supplied; per the input, there is no public exploit identified at time of analysis and no evidence of active exploitation. The headline 8.7 should be read with important caveats the raw CVSS metrics obscure: exploitation is NOT against default usage - it only triggers when an application deliberately calls Image.save with PDF append enabled against an attacker-influenced existing PDF, which is an uncommon code path. The AV:N/PR:N/UI:N metrics therefore describe worst-case exposure, but the realistic attack surface is narrower than the score alone implies. Net: a genuine, easy-to-weaponize DoS for the specific minority of deployments using PDF append, but a lower practical priority than an 8.7 suggests for the broad Pillow install base, since impact is confined to availability and gated by a non-default operation.

An attacker submits a specially crafted PDF (with a deeply nested or cyclic page tree, or many unique trailer offsets, or repeated non-cyclic /Kids references) to an application that appends new pages to it via Pillow's Image.save with PDF append enabled. When PdfParser parses the existing document, it recurses without cycle/duplication tracking and exhausts the Python stack (uncaught RecursionError) or consumes super-linear CPU and memory, crashing or hanging the service before any output is written. No public exploit code is referenced, but the malformed-PDF trigger is simple to construct from the advisory and test additions.