e-SIC Livre EUVD-2026-109108

Exploitation requires reaching the CAPTCHA generation endpoint restrito/inc/captcha.php on an e-SIC Livre instance (v0.2.2 or earlier) and supplying attacker-chosen values for the l, a, tf, and ql request parameters, which the application uses without validation to size/generate the image. The CVSS vector (PR:N/UI:N) implies no authentication or user interaction is needed, but the 'restrito' (restricted) path suggests the endpoint may sit behind an access-restricted area - defenders should confirm whether it is reachable without a valid session, as that is the single biggest limiter on real-world exploitability. No non-default configuration is named as a prerequisite; the limiting factors are the product's small deployment base and the need for the attacker to send enough crafted requests to actually exhaust memory/CPU.

The input CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, no-privilege, no-interaction flaw whose only impact is availability - there is no confidentiality or integrity loss. The supporting signals pull toward LOWER real-world urgency: EPSS is 0.26% (17th percentile), there is no CISA KEV listing, and the vuln.today Decision label is 'this_week' (not act_now/emergency). A public PoC reference (github.com/brynax/CVE-2026-50787) is listed but is not verified as working exploit code, so POC availability must not be read as active exploitation. One concrete tension exists: the vulnerable file sits under a path named 'restrito' (Portuguese for 'restricted'), which hints the CAPTCHA endpoint could live inside an authenticated/restricted area, yet the CVSS asserts PR:N (unauthenticated) - this should be verified against the actual deployment, because if the endpoint requires a session the realistic attack surface shrinks substantially. Net: this is a genuine but bounded availability issue - a real but non-emergency priority - not a high-CVSS-but-no-impact false alarm, though its low EPSS and the niche footprint of the affected product temper the urgency.

A remote attacker repeatedly requests restrito/inc/captcha.php supplying inflated values for the l, a, tf, and ql parameters, which the application passes unvalidated into CAPTCHA image generation, forcing the PHP process to allocate excessive memory and burn CPU. A short burst of such requests can exhaust server resources and render the e-SIC Livre instance unresponsive to legitimate users. A public PoC reference exists; it is not verified as working exploit code.